• Sometimes you just have to wonder how long computer security professionals will have to keep screaming “Don’t store passwords in plain-text” before people take notice. Getting an email like this from MasterCard really freaks me out:

    MasterCard

    I wonder if they store PINs in plain-text, too. It’s just sad when a credit card company’s policies allow something like this to get pushed in to production.

  • I really wonder why the Indian Railways, arguably one of the most active e-commerce sites in the country, needs to be offline for an hour every day.

    image

    Seriously!?

    I run a few web apps of my own and I’ve had only 50 minutes of downtime in an entire month. Yes, I know my app is nowhere near as complex as a railway reservation system. And yes, I know, those of you that are measuring up time in 5 nines are laughing at me, but give me a break – my services are in beta. Still, why does the IRCTC need an hour off every single day? Sure, as a customer, I’m somewhat inconvenienced, but as a developer I’m really curious as to what they’re doing in that hour.

  • 2011 has been a very interesting year for me. It’s the year I found out that my body is in far better shape than I give it credit for. The fact that I’ve done almost nothing to aid that over the last 30 years is, however, somewhat troubling. So, for 2012, I’ve decided that the biggest priority for me is to get more exercise.

    The funny thing about exercise is that you don’t really need to do a lot of it to start experiencing the benefits. And, you don’t really need to splurge on a gym, either. Just go take a walk. It really is that simple. If you’re getting absolutely no exercise right now, stepping up to nothing more than a brisk 30 minute walk every day will do wonders for your body. Assuming you’re already eating in a relatively healthy manner, a regular walk is all you really need to start burning off fat, increase your energy levels and generally feel better every day.

    Walking for half an hour isn’t difficult. What’s difficult is making it a habit. This video is what got me to finally turn this into a real priority for 2012. I hope it does the trick for you, too.

     

    23 and 1/2 hours: What is the single best thing we can do for our health?
  • When Windows 95 shipped, my primary machine was a 486/DX50 with 8MB of RAM. My test machine was a 386 with 4MB of RAM. The combined computing power and storage capacity of all the machines in my office is now exceeded by your cell phone.

    -- Raymond Chen, Microsoft.

  • I like Chrome. I really do. It’s a lovely browser. Fast, clean, minimal. But every so often I run into minor irritations like this, which is why I still use Firefox as my main browser.

    Take a look at what Chrome’s tabs look like once you have a lot of stuff going on:

    chrome

    Now compare that to Firefox:

    firefox

    The way I see it, at this point Chrome’s tabs are as useless as they are beautiful. Firefox shows you less tabs in one go, but at least I can use what I see and I can scroll through the tabs with my mouse’s scroll wheel.

  • The recent Onion article on the death of Steve Jobs really struck a chord with me:

    Jobs will be remembered both for the life-changing products he created and for the fact that he was able to sit down, think clearly, and execute his ideas

    If you really think about, that's a superhero power – the ability to sit down, think clearly and execute. I've always known that I have trouble finishing things. For as long as I can remember, I've always been a starter. I love the rush of embarking on a new project. The initial brainstorming and roughing out the first prototypes really give me a high. Unfortunately, after that I just fizzle out. The actual process of moving things from prototype to real world product always seems to bore me. Somewhere along the way, I generally lose interest and shelve things. As a result, I now have around 10,327 half-finished things.

    That sucks.

    Reading that piece on The Onion, however, made me take a good hard look at myself and I decided to make a few changes. One of the things I quickly noticed during my introspection was that I'm distracted very easily. Whether I'm writing code, watching television, reading a book or even trying to fall asleep, my mind is always buzzing with a million different thoughts. I'm not quite sure when that started happening, but now I find that it takes a serious effort for me to focus on a single train of thought for an extended period of time.

    There are just too many distractions. Too many devices crying for attention. Too many emails to process. Too many blogs to read. And the worst thing is that the default on every device or app is to let you know instantly when something happens. The list is just endless:

    • Email
    • RSS
    • Twitter
    • Facebook
    • Hacker News
    • etc., etc., etc.

     

    This stuff is Kryptonite.

    So, as the first step to regaining my superpowers, I've now decided to turn off every notification on every device or app that I own. That's right, everything. Hell, even my phone now makes noises only for incoming calls. No more "you've got mail", twitter alerts, Facebook messages or blog alerts to get in my way. Zero alerts. Period. No exceptions. Nada. Not on the phone, laptop or desktop.

    And you know what? The world suddenly seems like a more peaceful place. It's only been two days since I started doing this and already I can feel my thought process improving. Not only am I getting more work done, but I'm doing a better job at it than before.

    Try it, people. Turn off the notifications. There's important stuff to be done. Don't let a new tweet or email take your eyes off the ball.

  • I just finished setting up a fully automated incremental snapshot backup regime on my Windows 7 machine. Every night, my script creates an exact replica of my data and retains 3 days of snapshots. This means that I can go “back in time” for three days in case I need to recover something quickly. More importantly, the data isn’t hidden away in some obscure, proprietary file format – it’s sitting there just like a bunch of normal files. This makes it really easy to recover from a catastrophic failure of my main drive.

    Note: The process I’m about to describe is for geeks only. If you’re not a geek, maybe you should just buy a decent backup application and save yourself the trouble of doing this manually. If, on the other hand, you’ve got an hour to spare and you’re OK with dealing with things like Cygwin, ntrights and the Task Scheduler, read on!

    The core idea is to use rsync to make a backup of your data and use hardlinks to create the snapshots, as described by Mike Rubel.

    What you’ll need:

    1. Cygwin (we’ll be using rsync to make the backups)
    2. Windows 2003 Resource Kit (We need a copy of ntrights.exe to do this on Windows 7 Home Premium)
    3. A spare hard disk that’s at least the same size as the drive you want to backup

     

    Step 1: Install Cygwin

    Get the installer from the Cygwin site. Be sure to install the rsync package by selecting it from the installer:

    image

     

    Step 2: Prepare your backup disk

    Format your disk and create the following files:

    1) backup.sh

    This file creates the actual backup and manages moving around the snapshots. Just be sure to replace /cygdrive/d/* with your source (the location with the data you want to backup) and /cygdrive/e in the following script to point to your backup drive.

    rm -rf /cygdrive/e/backup.3
    mv /cygdrive/e/backup.2 /cygdrive/e/backup.3
    mv /cygdrive/e/backup.1 /cygdrive/e/backup.2
    cp -al /cygdrive/e/backup.0 /cygdrive/e/backup.1
    rsync -a /cygdrive/d/*  /cygdrive/e/backup.0/

     

    2) cygrun.bat

    This is the file that will startup a bash shell and run our backup script. We’ll be calling this from a scheduled task. The credit goes to Zenovations.com for this script:

    @echo off
    rem set HOME=c:\
    if "%DEF_PATH%"=="" set DEF_PATH=%PATH%
    set PATH=c:\cygwin\bin;%DEF_PATH%
    set myargs=%*
    if "%myargs%" == "" goto noarg
    rem echo %myargs%
    bash --rcfile "%HOME%/.bashrc" -i -c "%myargs%"
    c:
    rem pause
    sleep 1
    goto exit
    :noarg
    
    rxvt -e /usr/bin/bash --login -i
    
    :exit
    exit
    

    Step 3: Create a scheduled task

    Nothing special about this, just set up a standard scheduled task. I’ve set mine to trigger at 4:00 AM every day. The action should look like this:

    image

    Step 4: Making it work on Windows 7 Home Premium

    If you choose to run this task as a non-administrator user, you will need to ensure that your user account has the “Logon as a batch job” privilege. Unfortunately, Windows 7 Home Premium doesn’t give you an easy way to do this. So get yourself the Windows 2003 Resource Kit and use the ntrights.exe tool that comes with it to assign the privilege from the command line. Credits to Daniel for this tip.

    ntrights -u COMPUTER\User +r SeBatchLogonRight

     

    And that, my dear readers, should be it. You should (hopefully) have a fully automated, scheduled, incremental snapshot backup running of your important data.

  • Using the FileSystemWatcher to watch a folder for changes usually turns out to be a bad idea. From missing notifications to IOExceptions when trying to copy files, I’ve just given up on using FileSystemWatcher to do anything useful. I find that using Quartz.NET to set up a simple scheduled task that polls the folder occasionally is a more reliable and robust solution. Just remember to use stateful jobs to ensure your tasks don’t overlap.

  • I asked this question a few days ago on OpinionAided and to my buddies on Facebook. The results of my stunningly non-scientific research are in, and the world apparently thinks it’s a bad idea. Here are the results:

    OpinionAided

    Yes

    12

    No

    28

    Neutral

    6

    Total votes

    46

    Facebook

    Yes

    0

    No/not very useful

    5

    Maybe

    5

    Total votes

    10

    The comments on the Facebook poll shows me that the biggest concern is the desire to keep social and work profiles separate. Personally, I agree with this to a large degree. However, I think an app like this would be useful for planning “social projects”, like a camping trip or something like that with your friends and family. There are projects that need management that aren’t necessarily related to work.

  • 4 pixels, apparently.

    I have some JavaScript code that uses jQuery to get the height of a web page to determine whether we should do some auto-scrolling as we add new content to the page. I do this by comparing the height of the document and the window like this:

    var $win = $(window);
    var currentPos = $win.height() + $win.scrollTop();
    
    if (currentPos == $(document).height()) {
        // The user is at the bottom of the page.
        shouldScroll = true;
    } else {
        shouldScroll = false;
    }

    Unfortunately, Internet Explorer 8 acts weird when it comes to comparing the height of window and document. When there's no scroll bar on the page, the height of the document is always 4 pixels more than the height of the window. You can see this happening even on the jQuery documentation for height. Chrome, Firefox and IE9 will report 125px for both document and window height. IE8 will report the window height as 121px.

    So, $win.height() + $win.scrollTop() is always 4 pixels less than $(document).height() which causes my scrolling feature to kick in, even when there's no scrolling to do. As a result, I had to turn that elegant piece of code into this monstrosity just because of IE 8:

    // This first check is an ugly hack to deal with the fact that
    // IE 8 reports document height to be window height + 4 pixels
    // in the absence of a scroll bar.
    if ($win.scrollTop() == 0) {
        if (currentPos + 4 >= $(document).height()) {
            // User is at the bottom of the page
            scrollResult = true;
        } else {
            scrollResult = false;
        }
    } else {
        // Just the following code would be sufficient if it weren't
        // for IE 8.
        if (currentPos == $(document).height()) {
            // The user is at the bottom of the page.
            scrollResult = true;
        } else {
            scrollResult = false;
        }
    }
  • Logging is a critical piece of infrastructure for any application. On most of my projects, I use log4net because it’s a tried and tested framework that does exactly what it says on the box and stays out of your way. Today, I wanted to start logging security events in an application I’m building. By security events, I mean things like users logging in and out, changing passwords, and so on.

    I’m currently using text files to hold all my logs because I think logging infrastructure should be as simple as possible. For all the benefits of using a database to hold logs, I think it adds too many points where things could go wrong, potentially resulting in lost or missing log data. Now, when you’re keeping your logs in plain-text, you need to be careful to structure the log output so you can parse the data easily. The most straightforward way to do this without having to pepper your log data itself with magic strings is to use appropriate log levels.

    Out of the box, log4net provides five different log levels:

    1. Debug
    2. Error
    3. Fatal
    4. Info
    5. Warn

    I wanted to add things like “Login” and “Logout” to this list. It turns out that this is relatively straightforward to accomplish with log4net.

    The first thing you need to do is to create and register your new levels with the LogManager like this:

    log4net.Core.Level authLevel = new log4net.Core.Level(50000, "Auth");
    log4net.LogManager.GetRepository().LevelMap.Add(authLevel);
    

    It’s important that you do this before configuring log4net.

    Adding some extension methods makes it dead simple to start using the new log levels:

    public static class SecurityExtensions
    {
        static readonly log4net.Core.Level authLevel = new log4net.Core.Level(50000, "Auth");
    
        public static void Auth(this ILog log, string message)
        {
            log.Logger.Log(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType, 
                authLevel, message, null);
        }
    
        public static void AuthFormat(this ILog log, string message, params object[] args)
        {
            string formattedMessage = string.Format(message, args);
            log.Logger.Log(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType,
                authLevel, formattedMessage, null);
        }
    
    }

    And that’s it – now I can start using my new “Auth” logging level on any instance of ILog like this:

    SecurityLogger.AuthFormat("User logged in with id {0} from IP address {1}", id, Request.UserHostAddress);
  • I’m using the latest versions of NHibernate (3.0.0), MVCContrib (2.0.96) and Castle Windsor (2.5.1) in a new project I’ve just started. Sometimes when you’re playing with the cutting edge releases of open source products, things don’t always work well together.

    After putting everything together, ASP.NET gave me a Yellow Screen of Death:

    loaderror

    This is the framework trying to tell you that one of your dependencies is looking for a specific version of a library and the runtime is unable to find that particular version.

    Quick Tip #1: How do I figure out what the dependencies are?

    Use ildasm to open up the assembly and take a look at the assembly manifest. This will tell you exactly what the dependencies of an assembly are. Looking at the dump for the latest release of MVCContrib.Castle tells us that it needs an old version of Castle:

    image

    Ordinarily, you would resolve this by doing what’s called an Assembly Binding Redirection by sprinkling some magic dust that looks like this in the <runtime> section of your application configuration file:

    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="Castle.Windsor" publicKeyToken="407dd0808d44fbdc" culture="neutral" />
        <bindingRedirect oldVersion="2.1.0.0" newVersion="2.5.1.0" />
      </dependentAssembly>
    </assemblyBinding>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="Castle.Core" publicKeyToken="407dd0808d44fbdc" culture="neutral" />
        <bindingRedirect oldVersion="1.2.0.0" newVersion="2.5.1.0" />
      </dependentAssembly>
    </assemblyBinding>

    With this in your config file, the framework will now force dependencies to use the newer version of the library.

    Unfortunately, in this particular case, using this workaround only leads to another Yellow Screen:

    MethodNotFound

    In case you haven’t figured it out yet – now you’re really in trouble.

    This message is telling me that MVCContrib is using a method that is no longer available in the newer release of Castle Windsor. At this point, you have three options:

    1. Don’t use the latest versions of everything. Go back to earlier releases of all your dependencies until you find a sweet spot where everything works well with everything else.
    2. Wait for all the libraries you’re dependent on to catch up with each other and use the official releases
    3. Tweak the code and roll your own release

    Of course, I went with option three.

    I got the latest code from the MVCContrib Mercurial repository. A quick look at the project tells me that the problem is in the WindsorExtensions.cs file in the MVCContrib.Castle project. I also notice that the MVCContrib.Castle project is dependent on a couple of other Castle components:

    image

    I downloaded these off of the Castle website and copied over the framework 3.5 binaries to the bin folder in the MVCContrib source tree. I did a recompile at this point and the build was broken. This is a good thing because it means it’s picking up the new files that I just copied.

    The project was broken in two places – one was WindsorExtensions, which is what I want to fix. The other was WindsorModelBinder. I have no use for this, so I just took it out of the project and went back to fixing WindsorExtensions. A quick update to the RegisterControllers method got everything to compile again:

    public static IWindsorContainer RegisterControllers(this IWindsorContainer container, params Type[] controllerTypes) 
    { 
      foreach(var type in controllerTypes) 
      { 
        if(ControllerExtensions.IsController(type)) 
        { 
          container.Register(Component.For(type). 
              Named(type.FullName.ToLower()). 
              LifeStyle.Is(LifestyleType.Transient)); 
        } 
      }
    
      return container; 
    }

    Now I took the new binary, popped it into my project’s dependencies folder, crossed my fingers, and ran the project. Everything works! So, after an hour of digging through the dirt I now have a project that uses the latest versions of MVCContrib, NHibernate and Castle to work with each other.

  • Adobe KulerAdobe Kuler is a really great app to have in your toolkit if you spend any time designing. It's a simple service where you can contribute, rate and share colour schemes. It's a brilliant source of inspiration for design.

    In fact, the entire redesign of my blog's theme started off after I saw the Wintery Casual colour scheme on Kuler.

    You can use it on the web, or download it as an AIR app.

  • Last week, Yahoo! put Delicious on the chopping board. Delicious, if you haven’t ever heard of it, is a social bookmarking service that more or less brought on the whole idea of tagging stuff mainstream.

    Delicious has always been an instrumental part of my web browsing experience. Even if I never really used it to discover new content or to do any research, I’ve always valued the ability to have my bookmarks accessible from anywhere. I’ve been using the service for years now and I have a stack of interesting links saved up from over the years. Many of those links are probably not even active anymore, but it’s still nice to have an “Internet memory” of sorts. The thought of losing that data made me sick.

    Needless to say, when I saw the first tweets about Yahoo’s decision my first instinct was to export the data from their servers.

    When companies pitch customers about the benefits of cloud computing, one of the really strong points they make is about the safety of your data – that it’s reliably backed up, redundant and always accessible. Until the provider goes out of service or decides to cut you off, that is.  This got me thinking about the various other online services that I depend on and I started wondering how I would move on if they ever disappeared.

    I evaluated three things about each service:

    • What are the alternatives? 
      Are there any other services that could give me the same functionality at the same price range? Is there an open source product that I can host myself? Will existing tools work with the new solution?

    • How easy is it to backup all my data?
      Does the service give you any way to export all of the data that you own?

    • Is the data portable?
      Will it be easy to transition the data to another service?

    Email

    I have three email accounts that I use daily – one work account, one personal account, and a generic Gmail account. The work account and personal account are using Google Apps for Domains. The email addresses are on my own domain. This gives you a lot of options. If Google were to deny me service, or even go out of business (yeah, yeah, I know you’re rolling your eyes now, but just remember that stranger things have happened), I can easily maintain the continuity of my email. I could run an email server at home, or even rent a virtual machine online and run a server there. Sure, I would miss the awesome Gmail user interface, but I would still have an active email account and, for the most part, life would be the same.

    The Gmail account is a whole other story. I don’t control the gmail.com domain, which gives me exactly zero options with that email address. This is a bad thing. If your primary email account is on a domain that you don’t control, you should be be very, very scared. With services like Google Apps and Microsoft Office Live, there really isn’t any reason why you shouldn’t be owning your own domain and email accounts.

    Continuing the email service is one thing, but what about the emails themselves? It’s pretty easy to keep a full backup of your data in your own hands. Just configure an good old email client like Mozilla Thunderbird, Microsoft Outlook or Windows Live Mail to sync your email and keep it offline.

    Alternatives Many
    Portability Excellent
    Data backup Very easy

    Blog

    This blog is already self hosted, so I don’t have much to worry about here. If you’re using a blogging service like WordPress, Blogger or something else, you should take a good look at your options for importing and exporting your posts and comments.

    Alternatives Many
    Portability Good
    Data backup Very easy with the popular services like Blogger and WordPress

    Bookmarks

    I’ve been using Delicious to handle all my bookmarking needs. There are a few alternatives out there, but I’ve been considering rolling something of my own to do this instead. After all, I’ve never really used any of the “social” aspects of Delicious anyway so this would be an ideal candidate for a wholly self hosted solution. Thankfully, Delicious makes it very easy to export data.

    Alternatives Few
    Portability Not obvious
    Data backup Very easy

    Facebook

    Facebook is the real elephant in the room when it comes to data portability. How do I export my messages, status updates and “likes”? I’m not even sure it’s possible. Even if I could export all of this data, there’s no alternative social network I can move to with it anyway. Even so, the walled garden that is Facebook worries me.

    Alternatives None
    Portability Irrelevant
    Data backup Impossible / very hard

    Twitter

    I’ve been sharing some useful links and quips on Twitter. I’m not really too concerned about backing up my tweets at this point, but it’s comforting to know that there are ways to do this if I wanted to. My biggest gripe here is that Twitter doesn’t have a straightforward “export my data” option but there are ways to do this with the API and a whole bunch of third party services have cropped up to fill the void.

    Alternatives None
    Portability Irrelevant
    Data backup Easy

    StackOverflow

    Arguably the best backup option of all the services listed here, because they give you a sanitized database dump of the entire site on a regular basis. Doesn’t get much easier than this.

    Alternatives None
    Portability Irrelevant
    Data backup Very easy

    The bottom line is this  – there’s always an inherent risk when you decide to keep your data on somebody else’s servers. The lesson I’ve learned from the Delicious episode is that for any service where I’m creating content, I’ll now be paying close attention to how easy the service makes it to get my data out of their servers.

  • I think I've neglected blogging for too long. This is something I used to enjoy doing and somewhere along the way I completely forgot about it. So last week I decided to get back to it and started designing the new theme that you see here. I upgraded my blog engine (dasBlog) to a newer version that I downloaded and compiled.

    You'll notice that some of the content has disappeared. That's because I cherry picked the content while migrating. I've retained all posts that had comments or some level of traffic.