Cubic

Today I discovered OData.  Then I discovered GData.  Then I discovered that I don't like either one. The idea of a data standardization protocol is appealing on the surface, but the two "official" implementations of a common web protocol for data consumption are not my cup of tea.  I do like tea, however.  But I'm picky about my tea and I'm picky about how I communicate with web servers. First off, I don't like complicated protocols.  I find them annoying as do most other programmers.  This is one of the reasons why SOAP slipped on itself and fell on its derriere at the starting gate.  /hahagreatjoke I've been working with JSON a lot lately.  It benefits greatly from having native support in every popular scripting language and easy-to-integrate libraries in the few languages that don't.  So, if we want to develop a standard protocol, JSON is the starting and ending point for modern development. For some strange, bizarre reason, when...

I thought about titling this post "How to make a DBA's head explode" or "The blog post from hell:  A DBA's worst nightmare come true" or something like that.  Of the database administrators (DBAs) I've met, which haven't been that many, none of them liked my radical database design ideas. Traditional database design says to create a field (column) for every little fragment of data you want to store.  I've found that this approach causes all sorts of immediate complications both at the database design layer and the application layer, and you have to nail the table design right off the bat or there will be big problems later on.  A lot of people get lost in the details of creating the database table and then lost in the details of linking the application to the database.  Good database design is perceived to be hard and therefore a good portion of the DBA's job is secure. Over the past 1 1/2 years, I've been playing with an alternate ap...

It seems to be a rite of passage to author a login system - or several login systems - over the course of one's life as a web developer.  Some systems are more elegant than others but I have to ask:  Is it really necessary? Let me provide some background.  I was mulling one day and realized that every website I've ever come across has one of two problems: Multiple login systems all over the place with multiple registration mechanisms (the result of using open source products or just bad programming habits). Some homegrown, half-baked solution riddled with security issues and poor UI design choices that breaks in half the browsers out there and irritating every user who uses the system. Or some mix of both problems.  And don't think it is just limited to cheesy little one-off implementations.  Major big-name websites that people actually use every day are all in the same boat with the little dinky one-off sites. Then I got to thinking about how many man...

A few of my websites went down over the weekend as I moved them over to a new server.  I've been saving moving my two primary domains for a while but I had to bite the bullet and move them due to issues involving storage space. Let me say that I am incredibly happy to have moved my hosting over.  Particularly e-mail.  I spent several months carefully crafting a fairly intricate e-mail setup with postfix and dovecot.  Totally worth the effort.  I've eliminated approximately 95% of all incoming spam.  The difference is night and day:  deluge vs. sprinkle. Everything is running over SSL/TLS for e-mail.  And I'm using SSL/TLS for web administration. The downside is that I lose all of my ancient website layout for my main website.  The site was basically dead anyway so I turned it into a one-page site instead of the ugly mess that it was.

I just released a new project on GitHub: https://github.com/cubiclesoft/email_sms_mms_gateways If you aren't a developer, then you probably won't care.  Basically, I burned my weekend constructing a JSON array by hand that maps countries and carriers together that provide a free e-mail to SMS/MMS gateway.  Well, it is free for software developers.  Charges, of course, still apply to the recipient of the SMS/MMS messages. GitHub makes it really easy to keep that mess up-to-date.  Other people supply pull requests, I click a button to accept them.  Bam!  The list is updated.  Then everyone using the list pulls the latest list and...Bam!  Everyone's software is running with the absolute latest information.  It is a nice, clean system. I've got a use for this project but it is going to play a smaller role than I originally dreamed up. Carriers need to get their act together and form a consistent strategy that developers can rely upon....

I've read a number of articles out there about Google's new push to unify their Terms of Service and Privacy Policy documents.  Most of the articles are about "privacy experts" complaining about how great the old documents were.  I have a question:  Who gets to decide when someone is an expert?  Is it some specific minimum level of knowledge?  If so, I just ooze knowledge and therefore that makes me an expert on stuff. Anyway, I'm glad Google is unifying their 60 or so Terms of Services and Privacy Policies into just one AND being open about the change long in advance.  Nobody reads these things anyway and is just a way to cover a business' rear end from frivolous lawsuits.  After all, hot coffee is hot...well, duh!  It doesn't matter how the McDonald's vs. Hot Coffee Lady case actually went down because it is a symbol of today's messed up legal system. Back to topic, Terms of Service and Privacy Policy documents are usually a pain in the neck...

Previously, on Cubic :  The main character introduced a broad analysis of a new algorithm for calculating the entropy of passwords so that a threshold may be applied and weak passwords rejected.  Will our hero's new algorithm pass more rigorous testing or will his arch nemesis Statistics Boy defeat it?  Let's find out! Since my last publication, I've been busy doing some other things.  But this week I got back to working with this algorithm to see how good it actually is.  My primary goals with my tests were to figure out how well it performs against real-world data and to determine a baseline entropy threshold for the algorithm that rejects most bad passwords.  And what better real-world data is there than to use databases of passwords that were stolen from hacked websites? I ended up testing against two types of information.  The first type were hacking dictionaries.  These are specially formulated files designed to defeat commonly selected ...

A while back, I wrote a series of posts of creating a chair that would allow me to sit outside and soak up some rays.  Programmers are white and nerdy because they sit inside.  There are several benefits you can get from going outside: Fresh air The sounds of nature Sunlight Knowing what time of day it is Not looking like a pasty-white programmer/office worker Anyway, this post was an itch I've been meaning to scratch for a while to provide some closure and someone finally commented on it, so here goes... I used the chair for a few months.  (Feel free to take that sentence out of context.)  And it sort of worked.  It got me outside but I had several problems that I could never resolve to my satisfaction: 1)  The chair itself wasn't comfortable to sit in for an extended period of time.  I hate anything that provides so-called "back support".  As an intelligent alien lifeform on Earth (that's a joke, BTW), back "support" is more like back...

If you are like me, you dread adding multilingual support to applications.  It isn't that I do not like the various, rich cultures of our world, but rather that it is such a pain in the neck to implement multilingual support into an existing application from a programming perspective. One of the problems stems from the fact that nearly all programming languages are written in English and limited to the basic ASCII character set and targeted at English-speaking people.  Sure, I know of one programming language in Polish and a few others in other spoken languages but non-English programming languages are few and far between.  It really has nothing to do with America vs. whoever but more to do with settling on something we can use to get work done on a computer and English happens to fit nicely into a single byte (or less) and seems to be one of a handful of what I call "common trade languages" - that is, if you want to conduct business across international borders, it hel...

I was looking for some information on some high-performance MySQL questions lurking around in the back of my mind and found this very useful slideshow: How to Kill Mysql Performance On slide 40, there is a fairly complex and nearly unreadable (without going full screen) MySQL query that finds "useless" MySQL indexes by analyzing their cardinality .  Since it is not able to be copy-and-pasted, I figure I'll save someone the trouble.  It has been slightly modified for average data sets and to fix a case-sensitive bug: SELECT t.TABLE_SCHEMA, t.TABLE_NAME, s.INDEX_NAME, s.COLUMN_NAME, s.SEQ_IN_INDEX, (SELECT MAX(SEQ_IN_INDEX) FROM information_schema.STATISTICS AS s2 WHERE s.TABLE_SCHEMA = s2.TABLE_SCHEMA AND s.TABLE_NAME = s2.TABLE_NAME AND s.INDEX_NAME = s2.INDEX_NAME) AS `COLS_IN_INDEX`, s.CARDINALITY, t.TABLE_ROWS AS `ROWS`, ROUND(((s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) * 100), 2) AS `SEL %` FROM information_schema.STATISTICS AS s INNER JOIN informati...

When I visit websites that want me to create an account before doing something, I typically enter in bogus information and occasionally I see a "password meter" that determines that I've entered a "weak" password.  At least it is considered "weak" by some systems and "average/strong" in others.  Being the curious sort of person, I've been trying to come up with a good, consistent strategy for calculating password strength and then something useful to do with it.  I assume most developers only want to write password strength code one time, do something useful with it, and then move onto the next task. What constitutes a strong password?  An excellent question and something the industry seems to have difficulties figuring out at the moment.  NIST, the National Institute of Standards and Technology, has a few words to say on the topic.  Basically, password strength boils down to the number of bits of entropy that a password has. So the n...

I recently implemented a new feature called Cache Profiles into Barebones CMS . I'm a bit stuck on the documentation because I've had to stop and figure out how I'm going to create a mobile-friendly version of the website. I eat my own dog food after all. Om nom nom. The concept of a "mobile-friendly website" is foreign to some people. A lot of people think, "Our main website displays the exact same on the desktop, iOS, Android, etc. and therefore it is mobile!" That is NOT a mobile-friendly website. If a user has to use pinch-to-zoom or scroll horizontally at all to read the content, you have a desktop-only website. While desktop websites do display on most modern mobile devices, they are NOT mobile-friendly and users will hate you. Actually, that is a pretty good definition of a mobile-friendly website: "A mobile-friendly website is one that displays on small screens such as smartphones, scrolls only in the vertical direction, and is...

I've come to the inescapable conclusion that multiselect list boxes are not an intuitive UI element and are actually quite frustrating to use for most users. A set of two-state checkboxes is much more intuitive. In fact, I've found that anywhere that multiselect list boxes can be used, two-state checkboxes can easily replace them for a much more intuitive solution. Here's an example of a multiselect list box: Set the average user in front of a computer screen and ask him to deselect all selected items. The secret is to hold the 'Ctrl' key while clicking, but how often do people actually execute a 'Ctrl + click'? Not very often. Most users, in fact, aren't even aware of special key + click combos. These things are put into applications for power users AFTER the basic functionality is implemented. All functionality of a UI element should be available through a left click or a right click. This is User Interface Design 101. The multiselect li...

I and many other people have been waiting for a decade for this, but truly free SSL certificates with a root certificate installed in every browser is finally available. It used to be that to get a signed cert, you had to shell out tons of money. That was and is a ripoff. SSL certs cost ISPs nothing to produce and are pure profit. Even the EV validated certs (green bar) are a huge ripoff - sure the setup fee might make some sense where they do real checking, but, after that, the renewal process is entirely automated. Some places want $400 per certificate per year. This is one of the hosting/reseller industry's best-kept secrets. I've been keeping a very close eye on the free SSL certificate market for a while now. Every couple of months for the past decade, I've run a search query like "free SSL cert" and looked carefully at the results. The first organization that popped up on my radar was CACert.org . It was exciting when I first saw this because it ...

Ever since "Google Instant" was released by Google, the search box occasionally just disappears in Firefox: This seems to happen right around the moment when Google Instant directs Firefox to a new URL and I happen to be pressing the back button on my Logitech G500 Mouse . Which is, by the way, a very nice mouse for gaming and general-purpose use for us right-handed folks. Left-handed folks are, unfortunately, so neglected by computer equipment manufacturers. Anyway, I'm not sure why this bug happens. There is also another annoying bug with Google Instant that happens when I'm typing quickly. It switches from the main page to the Google Instant page. The search box is there with my search but complete search results refuse to show up and clicking the search button does nothing. Starting over and running the exact same search causes search results to show up. Google is one of those companies that doesn't publish their e-mail addresses anywhere. I do...

I've been using Windows for a really long time. As have many other geeks/nerds. I've seen my share of "Registry Cleaners", speedup tools, and tips from other people. All these things don't work. They really don't. You might get a temporary "boost" in certain areas, but a month later you'll be experiencing enough seemingly unrelated system problems that you'll end up reinstalling Windows. People always tell me their computers are slow and want to know how to speed it up. Today, I'm going to show you two ways to truly speed up a Windows-based computer and keep it lightning fast. First, fire up that slow computer and launch Task Manager. Go to the "Performance" tab, and look at the amount of memory being used. If the amount of memory being used exceeds 80% of the amount of available physical RAM, that means that portions of the OS and other programs are being moved to what is known as "swap space". Swap space...

It used to be, in order to have your own dedicated host, you had to plop down hundreds of dollars a month. Today, I noticed that 1and1 has a fantastic deal on dedicated hosting for $60/month on a permanent basis - this is not one of those 6 month deals. Cloud hosting and virtual hosting are, in my opinion, no longer competitive with this deal. I use dedicated hosting myself and absolutely love it. Most people opt for shared hosting, which introduces them to a world of hurt. If you have multiple websites, shared hosting gets expensive really fast. Plus shared hosting has significant downsides: - No control of the server. You are at the mercy of the hosting provider and their settings. - Web hosts cram hundreds, possibly thousands of websites onto a single box. Your website is not alone. - Greater risk at getting hacked because someone else on the same box got hacked. - You risk getting kicked off the hosting provider due to "too much CPU, RAM, or other resour...

For the past couple of weeks, I've been trying to get my domains unblocked from Hotmail/Live. I set up a new domain for Barebones CMS ( barebonescms.com ) and put forums on the site and forgot to add a SPF record for the domain. A couple weeks ago, Hotmail/Live servers decided that e-mail from barebonescms.com was invalid and therefore refused delivery. Due to the holidays being crazy, I was unable to get around to dealing with the problem. Then I discovered that Hotmail/Live was actually blocking ALL e-mail from my e-mail server regardless of domain. This sent me on a search to see how I could get unblocked. Of course, the first step was to fix my DNS records to add a SPF record. SPF-aware mail servers should really be assuming a default of: v=spf1 mx -all Or: v=spf1 a mx -all That way, most of us don't have to fiddle with silly things like this. The next two steps to getting off the Hotmail/Live block list is to go here: https://support.msn.com/ And requ...

Update February 27, 2011 - Windows 7 Service Pack 1 appeared in my update queue with the checkbox unchecked. Hmm. To update or not to update? Update January 14, 2011 - This appeared again in my Windows Updates. I figure installing it is okay now that Microsoft appears to have their ducks in a row. After the first fiasco, they probably took their time to release it correctly. This is the precursor to installing Windows 7 SP1. From Microsoft's website: "Windows 7 SP1 Release-to-Manufacturing (RTM) will be available in the first half of calendar year 2011. When released, it will be made available as an integrated release." This updates the installer in Windows 7 so it can upgrade to SP1 later. SP1 isn't available yet. What follows is the original post. Today, a mysterious Windows Update was released to all Windows 7 users. I'm going to preface this by saying what some Microsoft MVPs are saying: DO NOT INSTALL! The update says, "Install this ...

If you are building or using an e-commerce system and want to look all professional, you need invoice numbers. Invoice numbers are required, at the very least, for auditing purposes by most businesses. However, nothing says "not professional" quite like "dressing in a shirt that is flashier than a light pinstripe" or invoice numbers based solely on a MySQL 'auto_increment' field starting at '1' or, worse, a false arbitrary starting value. Searching Google for an industry-standard practice of creating an invoice number turns up pathetic results. So this blog entry aims to correct this severe oversight of the Internet and bring it down to the level of the average programmer. Businesses that are large enough have dedicated finance departments. These people like things to be EXTREMELY organized. If you are developing an application that is going to bring in money (e.g. an e-commerce solution), it needs to generate sequential orders that can be verif...