-
Setting up a MongoDB replicaset with AWS OpsWorks
I was recently tasked with setting up a MongoDB Replicaset.
Documentation for setting up a MongoDB Replicaset with OpsWorks was a bit on the sparse side and took a bit of trial and error. I ended up with this solution.
Continue Reading ... -
Fun with Ruby Hashes - Initializing with a block
The alternate title for this post was Poor man’s email load balancer.
A less common method for creating and using Ruby hashes is to initialize the hash with a block. This allows you to return and/or assign a value for a missing key. You can think of this as a parallel to using
method_missing
in Ruby classes and modules.The documentation for Hash.new with a block suggests
If a block is specified, it will be called with the hash object and the key, and should return the default value. It is the block’s responsibility to store the value in the hash if required.
Most often for the case where I wanted a default value returned, I would use
fetch
and set the default value for individual keys being looked for.my_hash = {} my_hash.fetch(:foo, "Not Set") => "Not Set" my_hash[:foo] = 'bar' my_hash.fetch(:foo, "Not Set") => "bar"
The same result can be achieved by initializing the hash with a block - any unknown keys requested from the hash will be initialized with a default value.
my_hash = Hash.new{|hash,key| hash[key] = "Not Set"} my_hash[:foo] => "Not Set" my_hash[:foo] = "bar" => "bar"
An alternative to initializing Hash with a block is to set the
default_proc=
on an existing hash.my_hash = {} my_hash[:foo] => nil my_proc = proc{|hash,key| hash[key] = "Not Set"} my_hash.default_proc = my_proc my_hash[:foo] => "Not Set"
So now we have a way of always returning a default value for a hash. Not very interesting in and of itself. What else could we do with our block backed hash?
Continue Reading ... -
Moving from Subversion to Git
I just finished moving all our repositories from subversion to git. There is lots of documentation on the web, but none of it ties everything together. Specifically, once you get your subversion repository including all branches and tags imported into a local copy of git, how do you push your git repository including all branches and tags to a remote git server? This was important to us because we have ongoing work in some branches which are not ready to be pushed to trunk yet.
I started out by following the excellent instructions at http://scie.nti.st/2007/11/14/hosting-git-repositories-the-easy-and-secure-way to setup our own git repository. Follow these instructions and create a simple git repository with only a couple of files to make sure it works and become familiar with it. At this point, you have a working central git repository but you are not yet ready to import your subversion repository. If using github, you can skip this step.
Next, go grab git2svn from github. This will download an entire subversion project, including branches and tags, into a local git repository. Depending on the size of your codebase and number of branches/tags, etc, this may take a while. Our smaller projects took about 10 minutes. Our larger project took almost an hour. It differs from git-svn in that it converts anything in subversion tags to actual git tags.
Now for the magic of pushing your local git repository imported from subversion to the central git repository your team will use. At this point, you should have a working central/remote git repository you are going to use.
Inside the root of your local git project, run these commands, replacing everything which is in caps.
git remote add origin git@YOUR_SERVER_HOSTNAME:YOUR_PROJECT_NAME.git git push origin master:refs/heads/master
After this runs, you have only pushed the trunk to the remote repository (now called master). You will also want to push all your tags and branches. With git, you have to explicitly push your tags.
git push --tags
And now for the branches. This was the only piece I could not find on the interweb. This is achieved by the command
git push --all
The --all command per the documentation specifies that all refs under $GIT_DIR/refs/heads/ be pushed rather than naming each ref to push.
That should be all there is to it. Our other developers were able to clone the newly minted git repository and start developing where they left off on their branch with the command:
git clone git@YOUR_SERVER_HOSTNAME:YOUR_PROJECT_NAME.git git checkout -b local_branch_name --track origin/remote_branch_name
-
Getting git +svn branches to follow remote branch
Andy Delcambre and Robby Russell both have excellent articles about getting up and running with git as an subversion client.
The one thing that had been getting me was the fact that the branch I created locally did not always stick to following the remote branch. It would start out that way, but once I checked out the master branch again, it would not always and definitely not consistently point toward the remote branch once I re-checked out my branch.
I finally figured out that the local and remote branch must be named differently. The character case matters! So if I had a remote branch of ITR-FOO and a local branch of itr-foo, it would loose track of the remote branch. The easy solution is to name the branches differently by using a “-” remotely and a “_” locally for names or just name the branches differently. Now, I use ITR-FOO remotely and itr_foo locally, or shorten the local name to itr_promos if I am using ITR-PROMOTIONS remotely.
For merging branching, using git is so much simpler, even if it is very retarded sometimes.
-
MileMeter has Launched
After a year of work, my company MileMeter has launched. We sell auto insurance by the mile with no vehicle tracking devices involved.
A big hats off to Chris Gay for working so hard for so many years so that we can could get to this point. Insurance rules had to be changed and it was difficult for many people to see the benefit selling insurance this way.
We are also one of very few, if not the only insurance company powered entirely by Ruby It certainly gave us an advantage as we were able to get a robust, well tested application out the door so quickly.
-
ruby-mysql-osx
I keep having to look this up…..
sudo env ARCHFLAGS=“-arch i386” gem install mysql — —with-mysql-config=/usr/local/mysql/bin/mysql_config
-
Pradipta's Rolodex
I woke up this morning to a 40+ thread of emails which originated by a recruiter sending 416 people job posting, all via TO:
It quickly turned into a somewhat fun conversation with lots of people and jokes. Rather quickly a google group named Pradipta’s Rolodex was created. Also followed was a Wikipedia entry (quickly deleted by Wikipedia admins), a FaceBook group, at least one domain registration as well as posts to Digg, Reddit and others.
Oh, the friday fun…..
-
Rspec Test render(:nothing = true)
I was trying to test one of my controllers was successfully hitting the render(:nothing = true) block. I could not find anything specifically in the API which handled this senario, so I ended up using have_text with a space as an argument.
@response.should have_text(" ")
-
Vote for Milemeter at AWS Startup Challenge
Go vote for Milemeter at AWS Startup Challenge and keep me gainfully employed!
We are proud to be 1 of 7 Finalist for the Amazon.com AWS Startup Challenge and will give our presentation next week at Amazon.com HQ. Milemeter is an innovative insurance start-up that will offer “auto insurance buy the mile”.
Update: Congratulations to Ooyala for winning the AWS Startup Challenge.
-
Testing private and protected methods with ruby
When I have to test my protected and private methods in ruby, I make the methods public for the scope of the test.
MyClass.send(:public, *MyClass.protected_instance_methods)
MyClass.send(:public, *MyClass.private_instance_methods)
Just place this code in your testing class substituting your class name. Include the namespace if applicable.
-
Transfer email from one google account to another
I recently signed up the netinlet.com email for Google apps for you domain
I had all my mail funneling to a gmail account to begin with, so I need to get all that email from the first google account to the new google apps account.
You can do with with POP, but you have to put in a different pop server name. Use pop.googlemail.com instead of pop.gmail.com. pop.gmail.com will not allow you to access via pop. Go figure.
Everything else stays the same, just make sure to use ssl on port 995.
The process takes a while. Mine has been running for about a half an hour and has only pulled over 300 emails so far. I have mine setup to pull over all email, so everything (INBOX, SENT, ARCHIVED) gets stuck into the inbox on the google apps account.
-
Google Apps - html verify takes a long time
I recently signed up the netinlet.com domain and a friends work domain for the Google Apps
You have to verify ownership of the domain to get the ball rolling. They allow you to either upload a unique html page to the domain or add a cname entry which points to google.com. I chose the former because it was simple and easy to do.
Google tells you up to 48 hours before the account is active. Well, 48 hours came and went. Then a whole week came and went and I heard nothing. Searches for why this was taking so long did not turn up much.
I finally stumbled upon some http log entries which show google was trying to verify. The entries looked like this:
216.239.36.136 – - [27/Mar/2007:22:58:25 +0000] “GET /googlehostedservice.html HTTP/1.0” 412 258 “-” “Jakarta Commons-HttpClient/3.0.1”
Look, a clue! Notice the 412 error code.
After some more hunting, it turns out that the verification process is triggering Apache mod_security. Luckily, the fix is simple.
If you don’t already have one, create a .htaccess file in you webserver root directory. In this file put
SecFilterEngine Off
My host is textdrive and I found a textdrive specific fix here but this fix should apply to almost everybody who is getting 412 error codes in their log files. -
Reinstall Solaris 10 on a T2000
My biggest gripe with the T2000 so far is actually with Solaris package management. pkgadd sucks because it does not handle dependencies and will not automagically download stuff from Sun. I really which they had something like the FreeBSD ports collection or apt-get or yum or something which automatically downloaded and install dependencies.
The T2000 ships (the one I received atleast) with Solaris 10 1/06 release. I want to play with ZFS which was included in the 6/06 release. Plus, I hope installing some of the other packages will be easier if I install the developer packages with some amount of libraries.
So not being able to find out how to upgrade the system from 1/06 to 6/06, I downloaded the 6/06 release and am doing a reinstall.
Since the T2000 does not ship with a video card, you have to install from the console. Not having used Solaris very much , it took a little while to figure out how to get the box to boot from the cdrom.
The trick is to get to the ok prompt. You can do this by logging in as root on the console and issuing the following command:
shutdown -y -g0 -i0 now
This leaves the server running but in init mode 0.
Now, you can boot from the cdrom and start the installer with the following command.
ok boot cdrom – nowin
This will start the installer in the console mode, rather than in X.
-
the T2000 has arrived
The T2000 has arrived!
I can’t wait to see what this thing will do with ruby and postgresql. This one has 6 cores and 8 gig of ram.
I will more than likely have to send it back at the end of the 60 day trial, but i’m very excited to get to use it as a test server in the meantime.
It’s time to put on my admin hat!
-
synergy - the kvm switch replacement
At work, I regularly use two computers, my primary development box (linux) and my other development box for the windows specific piece of the program I am working on.
I have one keyboard and mouse two monitors. I tried using a KVM switch, but that sucked because every time I would switch from linux to windows and back, the scroll wheel on my mouse quit working on the linux box.
I also tried using VNC for a while, but found the screen drawing was too slow.
On one of my rss feeds this morning, I ran across Synergy. This is one sweet program!
You designate one of your computers the primary computer and start a synergy server on that computer. On the other computer, you start a synergy client. Now, all you have to do to move the keyboard and mouse from one computer to the other is push the mouse to one side of the screen from either computer. So when I am on the linux box and want to use the windows box, I just push the mouse to the right of the screen and I am then using the windows computer. To get control back to the linux box, I just push the mouse to the left side of the screen, and voila! I’m working on the linux box again.
This setup only works if you have two monitors and one keyboard/mouse. And… it works very, very well.
TIP:
I start synergy daemon on the linux(master) box with crontab. On the windows box, there is a gui option to start looking for the master when the computer is turned on.@reboot /usr/bin/synergys —daemon —config /path/to/synergy.conf
-
ruby 1.8.4 on FreeBSD core dumps
I spent the better part of the last couple of days trying to track down why after upgrading to Ruby 1.8.4 on FreeBSD, I started getting core dumps in one particular place in my application.
After much time on IRC and some gdb voodoo I finally figured out the source of the problem. There appeared to be a stack management problem. Even with 64 meg of stack space, ruby would core dump. This behavior did not occur on OSX.
I emailed the ruby-core mailing list and one of the FreeBSD guys got right back to me.
Apparently the problem is with the freebsd pthread implementation and ruby.
Solution – install the port ruby18-nopthreads
Magically the problem disappears.
-
quick script for adding new svn files to repository
svn status | grep ? | awk ‘{print $2}’ | xargs svn add
This is on a FreeBSD box. I have noticed xargs on linux is slightly different – on linux try changing the xargs line to codeprexargs -i -t svn add {}/pre/code
-
updated rails from .13.1 to .14.3
The update went very smooth with this guide
All my work thus far has been on the database side, mapping incoming xml documents to my model. But there have been some significant performance increases in active record. My unit tests were taking on average 78 seconds on a 3.4 ghz pentium box running FreeBSD 5.3. That time has now been cut to 62 seconds on the same box. And that is with transactional fixtures turned off and instantiated fixtures turned on. Not too shabby!
Great work guys! I can’t praise you enough.
-
obfuscated mailto - ruby one liner
I have always been annoyed at having to write email addresses online such as codefoo at bar dot com/code. Damn the spambots!
I recently ran across this technique for obfuscating email addresses on web pages so that it appears normal to the user, but not something which could be easily parsed by a spambot.
You convert the link text and href to html characters.
becomes (added line breaks for readability)
</a>
Just a little bit more cryptic. The core method for converting a string to an html character string is just a one line ruby method, of course.
def string_to_htmlc(s) s.strip.unpack(“C*”).map{|ch| “#” + ch.to_s + “;” }.to_s end
A couple of things are going on here. codes.strip.unpack(“C*)/code We first remove any leading or trailing whitespace with the strip method. The unpack method on string is used for decoding a string (possibly with binary data in it) into an array. The argument code”C*"/code is an instruction that the next 0 to many characters should be turned into an unsigned integer, i.e. the number which represents the the ascii character. We now need to convert our array of integers into the html code for each character. The html code for a character is simply the ascii integer value for that character preceded by code#/code and ending with a code;/code. The ruby map mehtod takes care of this for us. Array#map invokes the block for each element in the array. Finally we convert the array back into a string with the code.to_s/code for our html pleasure. The code.to_s/code method on array is the same as calling codearray.join/code All you have to do now is just put some code in your rails helper module to output a full href.module MyHelper def to_html_email(address) email = string_to_htmlc(address) “a href=\”#{string_to_htmlc(‘mailto:’)}#{email}\“#{email}/a” end def string_to_htmlc(s) s.strip.unpack(“C*”).map{|ch| “#” + ch.to_s + “;” }.to_s end end
Now it should be safe to display an email address on a webpage. -
another great thing about ruby - the unit testing
The more I use ruby, the more I love it. I ran across this today – the ability to run individual unit tests.
You can run an individual test method within a test case by providing the -n switch after the ruby file containing the tests. the -n argument accepts either an absolute test method name or a regular expression which will run all the tests which match the expression.
codepre
ruby test/foo_test.rb
/pre/code
This runs all the tests within foo_test.rb.codepre
ruby test/foo_test.rb -n test_bar
/pre/code
This runs the individual test method named test_bar within foo_test.rbcodepre
ruby test/foo_test.rb -n /bar/
/pre/code
This runs all the test methods within foo_test.rb which contain the string “bar”. -
identity 2.0 - great presentation
One of the best presentations from OSCON given as a keynote by Dick Hardt has been published online. It’s a must see. I was blown away when I watched this at the conference. It’s an incredibly entertaining and interesting presentation.
-
office revenge - aluminum foil desk
When I first started at my current job, I was out sick for a couple of days and came back to my office totally re-arranged as a practical joke. Pictures were upside down, glasses taped to the desk, shoes hanging from the ceiling, and about 100 other small re-arrangements.
It took a while to get back at one of the instigators, but the opportunity finally arrived :) Deanna went on vacation last week!
A while back I had seen an email where someone’s desk was “foiled” and really liked the result. Total project time about 2 1/2 hours. So here it is: (all picts at flickr)
-
Interesting app - the semantic web
A friend of mine pointed me to an interesting app this afternoon. Piggy-Bank
The description from the site is
bq. Piggy Bank is an extension to the Firefox web browser that turns it into a “Semantic Web browser�It seems to take the various website data (via screen scrape) create an RDF document out of it. That information is stored in a central location which can be queried by the said application. For instance, one of the pieces of data it collects is location. So it could collect the location of all the apartments for rent from the apartment rental website. It would also collect the location from the bus terminal website. Ultimately you could do a query to find apartments within a given radius of all the bus terminal in you location and display it on a google map.
It’s a very interesting concept. I have looked at semantic web stuff before and understood the basic concepts of the underlying technology, but did not get what it could be used for. This app makes it fall into place a little more than before.
One of the things I still fail to understand about the semantic web stuff is how to go about using the data that is published. Nobody would publish the RDF/OWL model in the same way, just as to developers would come up with a slightly different database structure. It all stores the same data, but in a different way.
Using the apartment for instance. Two different property management companies publish an RDF document for the web.
Propery Management site 1 comes up with a model like this
codepre
Apartment:
Address:
line1
line2
city
…
Specs:
square_footage
number_of_bedroooms
…
/pre/codeAnd Property Management Site 2 comes up with a model like this:
codepre
Apartment:
addressLine1
addressLine2
city
…
squareFootage
numberOfBedroooms
…
/pre/codeThey both have exactly the same data, just modeled differently. One is more normalized than the other and the attributes/elements of the document are are slightly different.
Perhaps I am missing something but it seems that if you wanted a central storage location for semantic web stuff, you would have to do alot of mapping between one document and another. This would seem to limit the number of sites you could query because of the time and labor involved in mapping.
I really want to believe in widescale use of this technology, but I fail to see it right now.
-
new toy
It was time for a new toy… Since the old digital camera was old and busted, it was time to bring in the new and shiny.
I wound up getting a Nikon Coolpix 4800
I really like this camera. They did a good job with controls on the camera. You don’t have to push too many buttons to do what you want and it’s pretty intutive.
And to christen the camera, I put created a flickr account
There is supposed to be a flickr feed on the sidebar, but it does not seem to be working now. Ah… something else to get working.
-
new server
My host has moved locations and everyone is now running on new hardware.
The move was painless. For me atleast. Everything was working just fine when I tested it out a little while ago.
Hopefully the combination of new hardware and hosting facility will fix the downtime problems I (they) have been having.
From textdrive’s flickr account…
-
Switched from Fedora to Ubuntu
I switched from Fedora to Ubuntu last week on my computer at work and I could not be happier.
Setup was simple. I really like the apt-get, gentoo portage and BSD ports model. RPM is just too much of a pain.
One interesting thing about Ubuntu is that there is not a standard root account. Just like you do with OS X, you have to sudo everything. That’s fine with me. And if you really, really need root, all you have to do is sudo bash and you are root.
This biggest annoyance is that I can not find a postgresql 8.0 package for ubuntu. I really don’t want to have to maintain all the startup scritps myself.
Otherwise, I’m very happy with it so far. Hopefully it will stay that way.
-
Ruby Proc
I was looking at ruby proc while researching the best way to do mapping in ruby (xml-db and db-xml mappings) and ran across this blog posting on procs. The flexibility of ruby never ceases to amaze me.
http://www.ntecs.de/blog/Tech/Programming/Ruby/RubyMethodNamingConsistency.rdoc
-
OSCON Slides
Update: Received an email from oreilly listing all the slides from the conference…
I have been meaning to go back and collect the ruby slides from OSCON and finally got around to it.
Dependency Injection: Vitally Important or Totally Irrelevant
Yield to the Block: The power of Blocks in Ruby
I could not find Dave Thomas’ slides on the net in 1 minute or less. But I did find a ruby presentation I did not attend…
10 Things Every Java Programmer Should Know About Ruby
And some ajax stuff too…
-
Postgres on OSX
I’m finally ramping up for longer term development on OSX. I have been impressed with the platform for the most part. Small things are annoying, like zip corrupting files you are zipping (a friend tells me this is in part due to backward compatibility with OS 9)
I’m doing all my database work with Postgres When I first went about setting up postgres, you basically had to compile it yourself or use something like fink. I was not really happy with those solutions. After coming back from OSCON, I discovered a postgres installer from druware.com. This rocks. Point, Click, Install. In recent years, I have grown tired of building software myself after doing it for so many years on linux.
Now to access postgres from ruby and rails, you need to install the postgres driver for ruby. Change the gcc complier to 3.3 and install the postgres gem. If you have not used used any ruby libraries with compiled C extensions, you must first fix the version of ruby that ships with Tiger. with RubyGems installed, do
precode
deathstar:~ doug$ sudo gem install fixrbconfig; sudo fixrbconfig (only if broken osx ruby)
deathstar:~ doug$ sudo gcc_select 3.3
deathstar:~ doug$ sudo gem install postgres — —with-pgsql-dir=/Library/PostgreSQL8
/code/pre(You have to tell rubygems where druware installed postgres)
Now you are ready to start doing postgres development with ruby.
If you are using postgres on OSX, the installer from druware is definitely worth checking out.
-
Dependency Injection: Vitally Important or Totally Irrelevant
by Jim Weirich
Slides at http://onestepback.org/articles/depinj
Is Dependency Injection vitally important in a dynamically typed language
- Short version – no
- Medium version – maybe
- Long version – don’t know
Who are you? Perhaps not who you think you are.
Building a computer controlled coffee maker. When coffee in put – burner should be on. When pot not in or no coffee in put – burner should be off.
Talks about the problem of Concrete classes being tied together and show some solutions in java and ruby (ruby modeled off java code). Push problem out by using interfaces, constructor args, getter/setters, etc but problem is just moved from one place to another.
One solution – factory pattern. But… cumbersome and invasive (examples)
Another solution – Service Locators – invasive, order dependent (examples)Goes through a typical dependency injection system in ruby: DIY module
Gains: Flexibility and Testability Losses: complexity and indirection
This makes sense in java, but what about ruby?
Based dependency injection example in ruby on how java classes work.
Java classes are hard
- Not objects
- (mostly) source code constructs
- unchangable at runtime
- Class name directly identifies class
Ruby Classes are soft
- Just objects
- Runtime live
- changable at runtime
Is Dependency Injection relevant in dynamic languages – perhaps on very large projects, but the jury is still out.
-
OSCON 2005 - MetaProgramming
presenation by Glenn Vanderburg
What is meta programming? It’s Programming your programming language
Rubyist have been discovering metaprogramming. Ruby style and idioms are still changing and adapting
Ruby good for metaprogramming b/c
- Dynamic and reflexive – everything is open – blocks allow writing new control structures – most declarations are executable statements – only slightly less malleable than lisp (no macros) – unobtrusive
Examples…
attr_reader, attr_writer, and attr_accessor.
if written in ruby attr_reader would be written like (actually written in C ) precode class Module def attr_reader(*syms) syms.each do |sym| class_eval %{ def #{sym} @#{sym} end } end end /code/pre
Speaker goes through several implementations over time of different ways different people did metaprogramming with ruby.
How to think about metaprogramming
- Definiting new constructs for your programming Language
- so what do the constructs to? whatever you domain needs it to do.
Another way to think about metaprogramming is a new set of conceptual tools for eliminating duplication (and other smells) from your code.
And another way to think about it is how rails does it – almost as if you can talk you code – PersonTable has_a :name
Most DSLs also deal with other things ou don’t usually find in general-purpose languages
- Context dependence
- commands and sentences
- Units
- Large vocabularies
- Heirachy
Contexts – context for a new set of statements – a new scope (not in 1.8, but in 1.9) precode Struct.new(“Interval”, :start, :end) do def length @start – @end end end /code/pre
Backend code looks like if you wanted to add it to 1.8 precode class Struct initialize(*args, block) struct_class = #define struct using args struct_class_class_eval(block) if block_given? end end /code/pre
Another example of context from Systir system testing tool
precode add_user { name “Charles” password “secret” priviliges normal } /code/pre
Commands and Sentences
Multipart complex statements
ex. field(autoinc, :reg_id, pk) Overall, it’s just a methodcall – the first parameter – the type – is a method call precode def autoinc return FieldType::AutoInc.instance end /code/pre
Units
Domain specific – general purpose language deals with scalars – programs must maintain their knowledge ex 3.days.from_now Watch out for operator overloading
precode class Numeric def days self * 60 end end /code/pre
Large Vocabularies
override method_missing
Usage: Roman.XXII Roman.CCIX precode class Roman def self.missing_method(method_id) str = method_id.id2name roman_to_int(str) end def roman_to_int(string) … end end /code/pre
Resources:
http://www.vanderburg.org/Speaking/Stuff/oscon05.pdf http://hypermetrics.com/rubyhacker/coralbook/
-
OCON2005 - The Latest and craftiest attacks and penetration Techniques and tools
by Nitesh Dhanjani
Closed source tools not good for monitoring your own networks. Lots of times they give false positives and there is no way to verify whether the positive is correct or not.
- Methodology
- finding vulnerabilities using Google.com
- Using the Nessus framework
- Web application vulnerabilities
- Other useful AP tools
Attack and penetration methodology
- Discovery (whois, traceroute, search engines, etc)
- Scanning (ping sweeping, port scanning – find the live computers and scan)
- Enumeration (service Identification, banner grabbing)
- Exploiting known vulnerabilities (research on internet)
- Installing rootkits/cleaning logs (ador on linux)
Googling for Vulnerabilities
- Find private information that inadvertently have been made public
- Stealth: find info on google – does not tell site you are looking at them (especially w/ google cache)
- looking for patterns /*/admin
- looking for error messages
- find vnc desktops “VNC Desktop” inurl:5800 – no username – only passwords – user password generators to crack
- Webcams – /view/view.shtml axis /ViewerFrame?Mode=Motion /home/homeJ.html sample/LvAppl/ etc
Go to oreilly.net and search for his name for article on how to do this.
The Nessus Framework
- utomated vulnerability scanner
- Opensource
- Client Server Arch
- Extend (write plugins) using NASL (Nessus Attack Scripting Language)
Writing a simple NASL Plugin
Web application serves /src/passwd.incThis file contains username and passwords
the plugin will scan for this vulnerability and report it as a security whole (severe)
precode
if(description)
BLOCK
script_category (ACT_GATHER_INFO)
script_family (english:“CGI abuses”)
script_copyright(english:“foo bar baz”)include (“http_func.inc”); port = get_http_port(default:80) if (… vunerability…)
report it
end
/code/preSQL Injection
causes: Dynamic SQL and lack of input validation
Authors preference for SQL injection prevention are stored procedures.
There is also Blind SQL Injection. Does not rely on verbose SQL error messages. Attempt to fetch database data. Check out Absinthe ( http://0×90.org/ )
Cross Site Scripting (XSS)
- Occurrs when a webapplication does not html output encode user supplied data
- Example http://example.com/cgi-bin/welcome?cgi?text=lt;scriptgt;alert(document.cookie);lt;/scriptgt;
- Replace above example with any JS Code (steal cookies, hijack users sessions)
Burp Proxy
- Java based HTTP web proxy
- Alter http GET and POST requests on the fly
- get it from http://
Other tools -
- Metasploit (point, click,root) Framework for developing and testing exploit code – http://metasploit.com
- Wikto: automated google and webserver vulnerability scanning (and much more)
- http://sensepost.com/research/wikto/
- Ettercap Network MITM attacks, content filtering, sniffing, etc http://ettercap.sourceforge.net/
- Whax – live linux distro – Most AP tools/exploits included – http://iwhax.{com/net/org}?
- good book is Network Security Tools – O’Reilly
Update Doh! Guess what – typo does not escape the content of a blog post. So when I posted the straight text, I started getting javascript popups with my session id an name from the above javascript code – updated to escape with lt gt symbols.
-
Customizing Mac OSX using opensource
by Jordan Hubbard + Kevin Van Vechten
recompiling software which come pre-built w/ osx
Darwin is the os core of osx. Includes kernel, IOKit families, and BSD commands and libraries.
Darwin source – developer.apple.com/darwin || darwinsource.opendarwing.org
.tar.gz snapshots organized by release.OpenDarwin – community run site w/ standard opensource tools (bugzilla, cvs, irc, etc)
Webkit – webkit.opendarwind.org. Based on khtml/kjs
can progress liveDarwinPorts – similar to FreeBSD ports system. 2,500+ ports. Easy customization wiht “Variants”
Fink – Based on debian packages. 5K+ ports – offers pre-built packages.
Building Darwin
- know objective
- only replace system when necessary
- beware of software updates (have to re-apply mods)
- make backups
Potential Problems
- Default compiler problems (different gcc version)
- environment variables
- build aliases
- no private headers
- no static libraries
user __gcc_select__ to change and report compiler versions
environment variables (where system looks for some things)
- SRCROOT (src files)
- OBJROOT (object files)
- SYSROOT (debug bin)
- DSTROOT (final bin)
Variables (compile)
- MACOSX_DEPLOYMENT_TARGET (10.4)
- RC_RELEASE (Tiger)
- UNAME_RELEASE (8.0)
- RC_ARCH (ppci386)
- RC_ProjectName (name of project being built)
And many more compile time variables
Missing header files – private headers (ex. /usr/local/streams/streams.h /usr/local/lib/libkld.a)
No internal tools /usrl/local/kextool? – for building kernel modules
DarwinBuild – handles all the above incompatibilities
precode
- darwinbuild -init AC46 (ac46 is engineering build number)
- darwinbuild project_name
- darwinbuild bash
/code/pre
This will download sources build (missed point in which you could patch source) and install new binary
-
OSCON 2005 - Yield to the Block: The power of Blocks in Ruby
with Matz (ruby’s father)
Interesting presentation. Valuable information, but slides moved really quickly.
One of ruby’s biggest strengths is blocks.
Increasing in popularity. 65 attendees at rubyconf in 2004 – over 200 pre-registrations for rubyconf in 2005. Reflects growing popularity of ruby.
Why? Hacker preference and killer application
Rails brought ruby to the limelight.
Blocks are unique and powerful in ruby. You can think of blocks as high order function
Martin Fowler reference is a good intoduction to closures and blocks.
Most of the rest of the presentation were code examples which Matz went over very quickly.
Quote from Matz
You (the audience) should have better japanese than I have english.
-
OSCON 2005 - Thursday Keynote
Arrived about 15 minutes late…
Transforming Software Architecture into Internetwork Architecture
- Not tied to any platform
- Extensible
- Generic – general purpose
- Federated
- Identifier, Formats, and Protocol Standards
Internetwork Architecture of Global trade mirrors Internet/Sofware architecture. Standard containers and standard port protocol.
DHH
Secrets behind Ruby on Rails (same talk given at FOSCON)
Ruby on rails is an integrated stack of integrated frameworks. Ships with O/R mapper, MVC controller, etc. In other words a bunch of stuff that makes web developers happy!
Has had ~100k downloads in the last year.
Has created an ecosystem of people either partly or fully earning a living from developing w/ Rails.
250+ professionals from 36 countries. More than 5K+ weblog posts says Technorati. First book already has 6K+ orders. 7 more books coming. Definite interest and buzz around Rails.
Why is rails interesting?
- convention over configuration (no xml situps – how many time do you have to tell the computer to do the same thing?)
- As long as you follow the rails conventions, you don’t really have to do any configuration. But if you need to step out of the convention, rails supports it.
precode
class Post ActiveRecord::Base
belongs_to :weblog
has_many :comments
has_one :author, :class = Person
end
/code/pre
For example, there is no Author object in the database, so you can override the default and map it to Person (has_one line above)- Change is instant. Goal for rails was instant changes. Make a code or db change, refresh webbrowser, and you see your changes. No redeployment, no re-compilation, just save and referesh browser.
- This is built in functionality of Ruby, not Rails. Ruby has Introspection, Open Classes, and you can execute code in class definitions.
- Rails ships as a complete, integrated, and familiar stack. Gives you everything you need out of the box. Might seem like that reduces your freedom and flexibility but actually gives you more. Kinda like Apple computer. You buy the way they do things from hardware to software. Everything works and works well. That eliminates many of the problems with OS such as windows or linux and allows you to run and solve problems. (may have paraphrased the Apple computer comparison from last night FOSCON)
- Flexibility is overrated. Too many technologies are chasing technologies as if flexibility were free. Rails trumps flexibility and you get alot in return. Constraints are liberating. Don’t have to worry about all that infastructure and can solve problems.
HP w/ Linux (more vendor wind…)
and more wind, and more wind, and more wind touting how important opensource software is and how cool linux is. Thank you Mr. Obvious. Now talking about how much HP does for opensource. Thank you, that’s very valuable but I don’t think it earns you a spot as a keynote speaker.
Computational Origami
Origami is the japanese art of paperfolding. Decorative abstract stapes. The modern extenstion is sculptural art achieved by folding paper, usually folded from one piece of paper.
Showing picture of origami folded from one piece of paper – incredible. One sheet, no cuts, only folding. Wow!
So what changed in the world of origami that change the old way of using several sheets of paper to the artsy form of today? Mathmatics.
Can model on computer and translate to paper. Take a stickfigure, measure all the lengths and construct a set of equasions. Then can solve for the crease pattern. Has a program called TreeMaker available for download that aids with this.
Applications in the real world
Space telescopes, automotive applications to name a few. Speaker designed a lense for a sattelite/space telescope. Needed to compact it to put it into space. How did they get it on the shuttle? Origami creases to reduce size.
Airbags – used to design how an airbag flattens inside the steering wheel of a car.
Mitchell Baker Chief lizard wrangler
Portland U. Now distributes mozilla/firefox downloads – bouncer – distributes load for mozilla/firefox downloads. Portland U. is the “hub” for all the downloads.
Started a commercial (for profit) mozilla arm to pay ongoing development, be able to accept money from online ads, etc.
Lastly, Dick ? from Identity20.com (perhaps .org) was speaking. Very good speaker about and good presentation about the next generation of identity management and why stuff like Passport did not work.
-
FOSCON2005 @ FreeGeek
For anyone who was or was not able to attend OSCON for Ruby and Rails related things, FreeGeek (think through the PDXLUG) sponsored some of the ruby/rails speakers from OSCON to come down and give a talk. This was very cool.
I arrived a few minutes late and DHH was speaking about rails. Very cool, especially because it was not one of the talks he had given so far at OSCON (atleast that I had seen).
Also there was Vanerburg speaking about metaprogramming in Ruby. The material he presented was pretty interesting. His talk plus Dave Thomas’ talk at the beginning of the week really gets me excited about Ruby. WOW! It is such an incredible language. it has so much more to offer than what you can get out of the Pickaxe book (Book is excellent, just does not push all the boundaries of Ruby. That may have require another 500 pages.)
West spoke about recreating the NextStep API for flash called ActiveStep and integrating it with Rails. Pretty interesting, although I did not get some of what he was talking about when it was flash specific. I have never done anything w/ flash. Very interesting.
And lastly there was White Lucky Stiff. They were slightly beyond description. Two guys and a girl showing homemade artsy computer animations, playing music and telling jokes. All material, w/ the exception of a couple of jokes, was about… Ruby. And most of it was funny. Definitely not politically correct, but that’s what made it so fun.
Met Robby Russell and talked to him for a bit. Great guy.
FreeGeek rocks. Turns out FreeGeek is a non-profit that recycles computer and teaches people how to build computers and run linux (job training) in the Portland area. Their location is very cool. Kinda like a computer garage. I was very comfortable there. It was a good fit.
Also in attendance was Matz – He did not give a presentation but accepted a gift from FreeGeek. A Japanese to English Dictionary.
Update Phil corrected me. Sorry for the misinformation. Rich Kilmer talked about the ActiveStep Flash API. Why the lucky stuff rather than “White Luck Stiff”. And Matz was given a dictionary of American idioms.
Don’t trust my memory!
-
OSCON 2005 - Extracting Rails from Basecamp
Last session of the day. More rails!
Extracting Rails from Basecamp
Basecamp came from 37 Signals.
- Less people, more power
- Less money, more value
- Less resources, better use
- Less time, better time
Trust – the best technical decisions come from technical people when it comes down to developing applications.
Start w/ least amount of resource and then start to scale.
Tried to build half a product rather than a half ass product.
Less Software
Approach to software engineering under constraints was to write less software.
So why another framework?
Experienced PHP background w/ some java.
Basecamp originally written in PHP. Hit wall with PHP – it fought back against what he wanted it to do.
Inspired by java but it was too much enterprise. Too much focus on the 99.999% and not enough on the 98%. Geard toward building the amazon.com of software, not the single developer hacking away.
So… Liberate the good ideas from the different languages. Ruby was the new place to liberate those ideas and make them not hurt.
Calls himself a shallow programmer
- Aesthetics
- Joy
- Less
So halfway through Basecamp he realized this might be useful to other people. And now we need an extraction.
Doesn’t work to design a framework before you start coding. That’s the cart before the horse. You are then limited to what you designed.
Need application driven development to make good frameworks.
So why opensource it.
- Selfish. Let other people do some of the work. Write it youself or let some one else help you. Only works when there are selfish reasons on the other end (they gain something too)
- (and two other reasons)
And it works. 1000 patches in 9 months. Extract, pass, reap, rinse, repeat.
Now need to get traction for your opensource project. If nobody is looking, it does not matter.
Greatest fear as an opensource developer is obscurity. Need a network to reap the effects.
Opensource programmers need to get rid of their academic humbleness and bring rave about the good stuff. If you are not passionate, nobody else will. Need to set a baseline of excitement. Passion is infectious. You decide how high to set the bar. David set the bar very high!
Self delusions work!
Go Looking for Trouble. Tout advantages over the known. “If it bleeds, it leads”
Dealing with Traction
Now you need to scale your culture
- Early influx can bend you out of shape.
- Release not so early, then often. (get it mostly like you want it then release and release often. That way there is less debate about the way things should work)
- Set a viral example of kindness. Care and show direction for newbies. Don’t tell anyone to RTFM. That will drive your users off and set and example for your culture.
Items will be added to rails by necessity. Example i18n. Not many people using it. Some people have tried it, but once enough people need and are using i18n, it will appear almost automagically and be useful.
-
Best Hacker of the Year
Congrats to David Heinemeier Hansson for the O’Reilly/Google best hacker of the year
-
OSCON 2005 - State of the opensource databases
Ingres _ by CA_
Ingres r3 is the version which was put into opensource.
Features
- Value based table partitioning (a-c go here d-x go here, etc)
- can partition tables based on value of records
- No application change required
- parallel query execution
- may utlize more than one cpu on MP machines for a single query.
- single processor machines also benefit
- Advanced query optimization techniques (query decomposition, flattening, and rewrite)
- Federation through ingres star
- support two phase commits for distributed transactions
- Replication of master at one or more slaves
- can also have multiple masters where the other master acts as a slave when doing updates to one or the other
- next release to support grids
- admittly driver support is lacking
- winblows only db gui
MySQL with David and Monty
- runs on 87 gazillion platforms
- Connector/MXJ – embedded jdbc within java (embedded java database???)
- Storage engine slides…
- Special storage engines
- Archive – logging data you don’t want to delete or update
- Blackhole – allows replication but throws away all data
- MyISAM for logging: prefix locking allows fully concurrent inserts and reads
MySQL 5.0
<ul> <li>Stored procedures</li> <li>Triggers</li> <li>Views</li> <li>XA – distributed commits across different databases</li> <li>Data dictionary</li> <li>Server side cursors</li> <li>Precision Math – exact calculations with well defined rounding and atleast 56 digits precision. Very fast w/ static memory allocation</li> <li>Strict mode – ability to get rollback/errors instead of closest value/warning messages (eh? can tell you when it is a bad date, 02/31/2005)</li> <li>Federated storage engine</li> <li>greedy optimizer (fast multi table joins)</li> <li>instance manager (replaces mysqld_safe script)</li> <li>extenstion to <span class="caps">LOAD</span> <span class="caps">DATA</span> for doing transformations/calculations at time of load</li> <li>5.0 still has 327 bugs but 16 really bad bugs at time of this writing.</li> </ul><ul> <li>Upcoming features <ul> <li>partitioning (needed for 20 petabytes that one user is planning)</li> <li>replication additions – row based (physical) replication (normal is logical) + multi source replication</li> <li>global backup api</li> <li>mysql cluster w/ disk data (non indexed columns)</li> <li>Hash Merge joins</li> </ul></li>
</ul>
Firebird w/ Ann ?
- High concurrency, high performance
- low administration costs
- flexible architecture
- active project
Development seems to be fairly slow going. Borland reniged the opensource license and Firebird is a fork. First releases were mostly bug fixes. 1.0 and 1.5 can share same data file.
Firebird Strengths
<ul> <li>Flexible architecture</li> <li>processed based (fork)</li> <li>multi-threaded shared server</li> <li>embedded</li> <li>low admin cost <ul> <li>self balancing indexes</li> <li>cooperative garbage collection</li> <li>single file database</li> <li>transportable backup</li> </ul></li> </ul><p><i>Firebird future (2.0)</i></p>
- currently in alpha 3
- global temporary tables
- execute block
- physical backup
Vulcan
- in parallel development
- fork to work on 64bit arch
- internal sql
Postgresql 8.1
8.1 features are frozen now. beta release in mid-august or early september.
Key New Features:
- Indexes combined using bitmaps – index any attributes you want to query on later. then when you do a join across different attributes, the engine bitmaps the indexes and can perform very fast lookups (knows where to find pages and other data structures)
- Two-phase commit for distributed transactions
- Automatic vaccuum process
- Global shared buffer lock removed, improves SMP support
- Functions returning multiple out parameters (oracle feature)
- Shared row locks
Pervasive, Green Plum and EnterpriseDB and Unisys building products/businesses around Postgres. Approx 1.5 million downloads of 8.0.×. and lots of new users (notable NWS and Ameritrade)
- Value based table partitioning (a-c go here d-x go here, etc)
-
OSCON 2005 - Webwork vs. Spring spackdown
Matt Raible and Matthew Porter
Not much to report here. Mostly a bitch session about what’s wrong w/ java frameworks. I could not help but feel sorry after using rails for the last couple of months.
Matt and Matthew are both good presenters. Good light presentation for the day.
-
OSCON 2005 - Firefox extension development
Tools – XPIStubs (pronounced Zippy Stubs) Use this and forget half of what you need to know. Still needs some work.
Speaker looks like Hani (bileblog)
Looks like this tool stubs out everything you need to develop firefox extensions. Run the program to stub out program, do a ./configure make and it installs a plugin into firefox that pops up a window “Test”.
All you need to know to get started developing firefox extendsions are
- XPIStubs to get quickly stubbed out
- XUL and javascript for UI
- XulPlanet.com for reference
Extensions allow you to add new features to existing applications and add new functionality to browsers.
Why user firefox:
- Cross platform applications
- add content to the users browser
- provide the user w/ a better experience through client side customization
- easier than many alternatives
- b/c it’s cool
XUL
The xml interface language for mozilla/firefoxIt provides
- layout and base widget set
- uses css for styling
- event handling via javascript command sets
- overlays
And… it may be loaded remotely or locally.
Command Event
- trap events like button clicks and key presses and allow you to respond to those events.
Broadcasters
- like command but can push out
Controllers
- Command sets can call on controllers to respond to events (like focus)
- Controllers are javascript classes that update state for commands
RDF and Templates
- allows you to define a template for displaying RDF data
- Difficult to use but very cool
XBL Bindings
- XML binding language
- allows ou to create new widgets or modify existing widgets
XPCOM
- cross platform components
- in C++, XBL or javascript. Also support scripting languages (PyXPCOM)
- Components are global to all chrome packages
- possibly the most important part of GRE
XPI: Cross platform Installer
- packaged in a jar file
- handles cross platform installs
Dev Tools
- typically use text based tools (vim, emacs, notepad??)
- Dom Inspector
- cview (XPCOM inspector)
- Venkman (javascript debugger)
Not Bad – rest seems like it will be demos, so shutting down to save batter power.
Update – ACK! It almost looks like jelly – programming in XML – WAY WAY Verbose
-
OSCON 2005 Keynote
Over the keynote was just OK. Not terribly exciting.
Tim O’Reilly is an awsome speaker as always. He seemed to keep it short this time for some reason. one thing he said that struck a chord, was once you create an standard, values moves up the stack. He believes opensource is doing this now, moving up the stack of standards (hardware).
Next up was Kim Polase (think I got her last name right). Good speaker but did not need to be delivering something as part of the keynote. Her talk seemed to be a plug for Spikesource.
Next up was Andrew Morton, linux kernel hacker extradonaire for OSDN. Difficult to understand b/c of how he spoke into the mic. Definitely a developer. Spoke a little in a drone about the integration of opensource and the commercial world.
Lastly was an interview with Jonathan Schwartz. Says he is happy to see an opensource implementation of Java (apache harmony project) but license for Java will not be open b/c they don’t want it to fork. Of opensolaris, says there is now no need ot compare big, bad closed source solaris to open linux. Can now compare the features of one to the other since they are both open. And to show that he was not 100% full of shit (maybe that is a little strong) said netbeans has the features it has today because of eclipse.
I think I would have rather have seen Tim give the entire keynote. I did not get much from any of the other speakers.
Update: Introduced myself to David HH (Rails) after keynote. Nice guy. Awsome framework.
-
OSCON 2005 - Learning XSLT
This update is late since my server was down during the track. Also my notes were pretty shoddy since there was so much info I was trying to digest plus I was getting sick during the track. My ribs ached and I my teeth were chattering b/c I was so cold. I believe I had a fever. Must have been some kind of virus.
The last time I tried using XSLT, I really, really did not like it. Lots of frustration and curse words. But given that I have to work with XSLT in my current project (to transform word xml templates) I decided to attend. I was going to attend Eric Hatchers Opensource gems, but that talk seemed to be mostly about Lucene and using a few opensource java projects. Interesting but given ruby has changed my interest in java and I need to use XSLT, well…
I’ll spare you my shoddy notes. Have a look at the speakers slides from the class. My notes mostly copied much of what was in the slides anyway. Plus the slides mirror much of what is going to be in the speakers upcoming Oreilly book.
Evan Lenz did an excellent job at presenting XSLT in a clear, very understandable way. I walked away feeling brain overload but feel like I learned something that I can apply.
Background on speaker, Evan Lenz
- Recommends Michael Kay’s XSLT Programmers Reference
- Participated on the XSL Working Group for a couple of years
- Wrote XSLT 1.0 Pocket Reference
- Preparing for PhD program in Digital Arts and Experimental Media
-
bidwell down (AGAIN!)
Well it was yesterday during OSCON and prevented me from blogging.
This is getting nuts. Seems to be occurring 2-3 times/week lately.
I really like textdrive but the downtime is getting really annoying. Particularly since I am trying to blog OSCON and the server goes down right in the middle of a track.
They are using FreeBSD, which I really like, but when you look at the status of bidwell when it is down (status.textdrive.com) it seems to be __fsck__ing for a long long time. Why doesn’t BSD have journaling file systems like linux. I understand why they can’t use linux’ but seems like they would have started development on one. On the linux boxes I use, it is so nice not to have to go through the fsck.
-
OSCON 2005 - Learning Ajax
You’ll walk away with
- Enought code to be dangerous
Damn. I thought I was already dangerous. Crap.
Demo Life in a text area
Interesting – autosave in a textarea – much like autosave in a text editor or something like MS Word.What is ajax
- still being defined – good portion still up to you
- No page refreshes – Don’t make me blink
- don’t make users and developers learn new idioms.
- Technology should not slow you down – ajax does not fundamentally change what you have been doing.
- Better interfaces without redesigning from ground up.
Should turn browser into a client for your protocol/api
Good, Bad, Ugly
- Good – more responsive, more intuitive interfaces
- Bad – Inaccessible by default (google web accellerator)
- ugly – debugging takes a village
When is ajax the answer
- give advantages of desktop apps in a web browser.
- when you need to do things that traditional request/refresh can not accomplish
- when the competition does it (you gotta do it too)
- when it makes the users experience better, not worse
Ajax basically manipulates the DOM. Everything is a node.
It’s moving a little slow at the moment. Talking about the javascript api for manipulating the dom and about how not everything is a node (text for example)
Easiest thing to make code portable is use getDocumentById() call
The speaker is sick! a big chunk of custom javascript for moving around paragraphs on a page. Glad there are toolkits for this. It would sound like a turrets party if I had to do it.
Did not know this – can set style propery of any node and can access css styles using CamelCase names.
Mozilla and MSDN have good dhtml references and speaker thinks MSDN has the best.
Limitations can’t request resources which are not on the same domain (XMLHttpRequests). you could proxy if needed
~4k is the usual typical upper and lower limit of what you can store in client cache (cookies) on a per domain level
Browser incompatibilities – write to the spec and use http://quirksmode.org as a reference for cross platform incompatibilities.
IE has conditional comments – block of code is commented out, but runs in appropriate browser. For example would only run in IE5 or IE5.5, or IE6, etc. Conditional Comments are not used very often, but very useful for determining which one of the many xmlhttprequest objects to load.
.innerHtml is a read/write attribute which modifies the dom. Should uses sparingly but is very useful.
.innerHTML example
precode
var fooNode = document.getElementById(“foo”);
var parentContents = node.innerHTML; // where innerHTML = ‘div id=’foo’/’
node.innerHTML = parentContents;
// fooNode is no longer a valid reference here
/code/pre
Point is if your program depends on a node being there, like an onclick handler, it may be going if you do not use innerHTML judiciously.What to return
- html
- easy to insert into document (fast)
- can return a string – easy to debug
- difficult to make portable
- implies replacement, not updates
- xml
- usually supported, MUST use “text/xml” document type
- doesn’t tie your server to your rendering
- you’ll need to buildUI on the client
- xml is typically not fast b/c you have to traverse the document (usually w dom)
- Plain text
- javascript
- fastest for large data sets
- eval() is the fastest parser available
- native language of you scripting environment
- skips the xml-to-data structure step
- app more likely to speak xml or html
- JSON helps (standard proposed by ?? – a lightweight subset of what can be descript in javascript literal)
- fastest for large data sets
You could send back javascript for large data sets where the javascript you send back would have something like a large dataset in an array. Smaller in size and faster to render than xml/html.
Engineering for ajax
- Server-side design principals
- ajax-style UIs should call the REST APIs you apps already expose – example Flickr
- multiple points of entry
- Single request, single action
- more requests, smaller requests
- When retro-fitting existing apps, wrap at the module level, don’t write new code
Back from break – talking about autosaving
- xmlhttp for moving data back and forth. Use HTTP POST verb, idempotence matters.
- serInterval() for occasional execution
- event handlers wired to Nodes, IDs
- brittle – hard to maintain or reuse
XMLHTTP Basics
- synchronous or async communications (most calls will be asynchronous)
- simple callback scheme for status
- some verbs problematic (Safari KHTML)
- HEAD
- PUT
- File upload not available cross-browser
- can be handled with iframes and form hacks
Now covering different ajax toolkits
Prototype by Sams Stevenson Ajax framework baked into Rails http://prototype.conio.net/
Dojo Ajax framework written by speaker, Alex Russell http://dojoframework.org
The toolkits (showing Dojo) have built-in graphics for UI display, example a progress indicator or spinner.
Whoa…. Dojo is pretty impressive. As I understand it, it’s sorta like tapestry but for ajax. you create widgets for say an autosaving text area. You can drop a widget on any part of your app and override default values by providing a dojo widget html fragment (div with some specific elements). Not tied to dom id, node, etc.
Debugging Tools
- Mozilla JS console
- Safari JS console
- Opera JS console
- IE Script Debugger
- Rhino or WSH – command line JS
Rhino command line example
java -jar js.jarbrings you into a javascript shell (like irb or python shell) poor interactive command line
example.js
precode
function foo() { print(“BAR”) };
/code/prejava -jar js.jar example.js
precode
js foo()
BAR
js
/code/preAdvanced Tools
- LiveHTTPHeaders – Mozilla/FF – Mozilla extension
- Venkman – Mozilla/FF JS debugger
- Squarefree JS Console bookmarklet
- MSE JS debugger for IE
- Konqueror
- VirtualPC/VMWare (for testing different browsers)
- Ethereal (w00t!)
- your tenaciousness
The talk was pretty good. Did not find myself getting bored through alot of it. I’m just glad someone else develops the JS libraries so I don’t have to.
Update Did not get to finish blogging while in the class b/c the server where I host netinlet.com went down (pretty much until the end of the conference that day). Was able to save all the content offline though and updated that. This is the repost of original + additional content.
-
OSCON 2005 - Day 2
On the agenda for today is “Learning Ajax” with Alex Russell and probably the XSLT track with Lentz. As much as I hate XSLT, I should probably go because I am having to use it for my current project. Perhaps I’ll learn something.
Was just looking over my blog from yesterday, and they pretty much suck as compared to this and this
Mine seem more like notes. -
OSCON 2005 - Day 1 (Rails w/ DHH)
Kickoff – should be a code heavy presentation…
Install ruby dated 12/25/2004
gem install rails to install rails (requires ruby gems)
Demo based around creating a blog app.
David is giving a detailed explanation of directory structure and built in webserver. Seems to be standard stuff in docs. Major point is that everything is layed out for you so you can get started more quickly and do not have to make those decisions.
… Speaks about the ./script/generate program which stubs out controllers, models, etc.
if a rhtml file is named the same as a method on the appropriate controller, that rhtml file will be rendered by default as the return from the action method.
precoderedirect_to :action = “method_name”/code/pre will jump to another action method on controller.
./script/destroy can remove models/controller/etc just like it can generate them.
Rails has extended the to_s method to include parameters (for date) so you can say my_date.to_s(:long) or my_date.to_s(:short)
foreign key names are not plural – should be same as model name. fk or comments to posts is post_id not posts_id (sorry if that one is not in context of anything else)
can specify foreign keys when defining the relationship
precodehas_many :comments, :foreign_key = “crazy_dba_convention_id”/code/prewith ./script/console you can interact directly with your model.
Pass in :locals { :variable = my_variable } you can render specific to what ever scope you are in.
Foreign key collections have extra convience methods such as create and build.
@post.comments.create(blah) where comments is a collections of comments on post.layout the reverse of jsp include. view maps to controller name and is used as a template for any html that needs to be rendered for that controller.
Use ApplicationController which was generated as part of generating your project for extension points such as authentication (ApplicationController is a base class of all other generated Action Controllers)
Unit tests with fixtures, fixtures load the entire fixture file for that db class and loads the values into instance variables by their name.
precode
def test_fixtures_work
assert_equal “FooBarBaz”, @my_first_post[‘title’]
end
/code/pre
Where there is a fixture entry with the title my_first_post with the title of ‘FooBarBaz’Unit tests usually only useful for testing your methods and the domain model.
Functional Testing Mocks already built for simulating gets and posts. Used for testing controllers and workflow of controllers. Can assert things such as responses (assert_response :success assert_template ‘foobar’)
When functional testing, you can test create or update methods similar to this: (code may make no sense, but methods will be like this)
precode
def test_create_post
post :create, :post = { :title = “foo”, :body = “bar” }
assert_response :redirect
assert_kind_of Post, Post.find_by_title(“This is my title”)
post :create, :post = { :title = "", :body = “bar” }
assert_response :success
assert_equal “don’t leave me out”, assigns(:post) .errors_on(:title)
end
/code/preAJAX
In template do
precode
%= javascript_include :defaults %
/code/pre
damnit, think the javascript_include is correct but may be wrong – DHH moved on.use the remote call replacement (linkto_remote instead of link_to for example) and pass in parameters (controller, id of element in html, etc)
can call precoderender :nothing = true/code/pre in action if nothing needs to be rendered for ajax call
can distinguish ajxx from non ajax by using the method request.xml_http_request?
DHH must be tired – he’s ajaxing the wrong files and it’s getting slightly confusing.
Need to clear input fields when ajaxing a form. Example if you have inputs for name and address, you will have to clear the name and address input boxes.
-
OSCON 2005 - Day 1 (Ruby w/ Dave Thomas)
Finally…, it’s here. And the line up for today is Intro to ruby w/ Dave Thomas and Rails with DHH.
Dave Thomas is one of my most favorite technical authors – this should be good…
Introduction to Ruby
Is programming still fun? in and of itself it is fun – it’s the language and the tools. Rise of scripting language make it more fun b/c less time to run program.
Ruby born in japan 1994 – Mats
Ruby passes the 5 minute test.
Wait – this is funny – Dave is presenting in socks.
Ruby removes alot of the inherited cruft of other languages – no need to put () around method and class definitions – don’t need to put ; at the end of a line. These things are unnecessary -the compiler/interpreter can figure it out.
new is not a keyword. It is built into the object. Makes overriding the functionality of creating the object more flexible (perhaps by using class level variables?)
attributes begin w/ @
Attributes and methods are one and the same. Makes for universal access
precode
@my_var
attr_reader :my_var
/code/preis the same as
precode
def my_var=(x)
@a = x
end
def myvar
return @a
end
/code/preBlocks and iterators are pervasive in Ruby
The santa clause theory: precode3.times { puts “Ho!” }/code/prevariable </table> is called a block parameteryield inside a method definition looks at code and stores in your “back pocket” which it executes later. (Thats a pretty crappy writeup…)
Ruby convention for iterators. Block should test for params. If block is not given , code should store in an array and return at the end of the method/iterator call.
Blocks as callbacks – use callback syntax as argument to initialize. If block not given, nil is stored. Can use later like
precode
callback.execute if callback
/code/preResource management w/ blocks. Use block with resources to ensure resources are closed afterwards.
precode
File.open(‘/etc/passwd’) do
#… do something
end
/code/preFile will be closed automagically at the end of the block.
Did not know this. Per-statement exception handling
precode
def x(name)
f = File.open(name)
yield f ensure f.close
end
/code/pre
where yield f ensure f.close is the per statement exception handlingTransparent block passing
precode
def x(name, callback)
File.open(name, callback)
end
/code/preDuck typing. Ruby has strongly-typed objects but untyped variables and methods. Type is determined by object protocol (by what object can do) Just have to make sure the types you are passing in support the methods that the object needs. If it walks like a duck and talks like a duck, it must be a duck.
Ruby community differentiates the type and class of an object
* type: what it can do * class: what generated it (who created this object)Metaprogramming mini DSL’s within you classes
How do we get there:- Classes are open and can be extended – ex: can add stuff to string. ex – could add an encryption method to string so you could say cat.encrypt. yes it is dangerous to redefine core class methods like overriding the + method on Fixednum, but just b/c some idiot might do it doesn’t mean it should not be there. I you do something stupid, take ourself out to the parking lot and beat self w/ rubber hose.
- Definitions are active Add to classes with things such as adding tomorrow and yesterday methods to the Time class. One thing that was really driven home for me is that you can execute arbitrary code in you classes (functional). For ex. Caching. in one of your classes, you could read a file and store it in a string as part of the definition. Then methods on the call would have ready acccess to the string or array. Put another way, you can write code that executes during class definitions.
- All methods calls have a receiver “ruby”.length “ruby” is the receiver.
This is very powerful for metaprogramming
precode
class Doug
end
class Bryant
endvariable = day.even? Doug: Bryant
variable.do_something
/code/preLearned you can use the “inherited(subclass)” method on base classes and will automagically be called when you extend the base class.
Other stuff
Object space can tell you about objects at runtime. ex. give me all the strings in my program. Useful for such things as debugging – why is that person object still hanging aroundDave Thomas is an excellent speaker. I was very impressed. If you ever get a chance to hear him speak, do it. He has a very clear and concise way of explaining things. Not to mention a good sense of humor. He keeps things technical and assumes the audience are not all dumbasses – he knows we have all done some sort of software development before and does not stick on the syntax of the language.
-
ruby, ruby, ruby. learning ruby
I have been studying ruby very closely this week while trying build up my ruby chops.
Some interesting articles I ran across…
Explanation of class self At ruby garden here and
hereAnd another interesting article about ruby garbage collection
-
OSCON 2005
I just got signed up for OSCON 2005 in Portland. I’m totally stoked. There is a great line up this year.
Some of the tracks I intend to attend… (Very Ruby Heavy)
- Intro to Ruby w/ Dave Thomas
- Ruby on Rails: Enjoying the Ride of Programming
- Learning Ajax
- Integrate: Building a Site from Open Source Gems
- Application Development With Firefox and Mozilla
- WebWork vs. Spring MVC Smackdown
- States of the Databases
- Open Office Xml Doc Format
- SiteMesh: A Simple Approach to Web Site Layout
- Tapestry In Action
- Ruby Blocks
- Pragmatic Project Automation with Ruby
- Metaprogramming Ruby
- Dependency Injection: irrelevant?
Holy Cow! I knew it was ruby heavy, but did did not realize how heavy it was until I saw it listed here.