Cubic

I just released a new project on GitHub: https://github.com/cubiclesoft/email_sms_mms_gateways If you aren't a developer, then you probably won't care.  Basically, I burned my weekend constructing a JSON array by hand that maps countries and carriers together that provide a free e-mail to SMS/MMS gateway.  Well, it is free for software developers.  Charges, of course, still apply to the recipient of the SMS/MMS messages. GitHub makes it really easy to keep that mess up-to-date.  Other people supply pull requests, I click a button to accept them.  Bam!  The list is updated.  Then everyone using the list pulls the latest list and...Bam!  Everyone's software is running with the absolute latest information.  It is a nice, clean system. I've got a use for this project but it is going to play a smaller role than I originally dreamed up. Carriers need to get their act together and form a consistent strategy that developers can rely upon....

I've read a number of articles out there about Google's new push to unify their Terms of Service and Privacy Policy documents.  Most of the articles are about "privacy experts" complaining about how great the old documents were.  I have a question:  Who gets to decide when someone is an expert?  Is it some specific minimum level of knowledge?  If so, I just ooze knowledge and therefore that makes me an expert on stuff. Anyway, I'm glad Google is unifying their 60 or so Terms of Services and Privacy Policies into just one AND being open about the change long in advance.  Nobody reads these things anyway and is just a way to cover a business' rear end from frivolous lawsuits.  After all, hot coffee is hot...well, duh!  It doesn't matter how the McDonald's vs. Hot Coffee Lady case actually went down because it is a symbol of today's messed up legal system. Back to topic, Terms of Service and Privacy Policy documents are usually a pain in the neck...

Previously, on Cubic :  The main character introduced a broad analysis of a new algorithm for calculating the entropy of passwords so that a threshold may be applied and weak passwords rejected.  Will our hero's new algorithm pass more rigorous testing or will his arch nemesis Statistics Boy defeat it?  Let's find out! Since my last publication, I've been busy doing some other things.  But this week I got back to working with this algorithm to see how good it actually is.  My primary goals with my tests were to figure out how well it performs against real-world data and to determine a baseline entropy threshold for the algorithm that rejects most bad passwords.  And what better real-world data is there than to use databases of passwords that were stolen from hacked websites? I ended up testing against two types of information.  The first type were hacking dictionaries.  These are specially formulated files designed to defeat commonly selected ...

A while back, I wrote a series of posts of creating a chair that would allow me to sit outside and soak up some rays.  Programmers are white and nerdy because they sit inside.  There are several benefits you can get from going outside: Fresh air The sounds of nature Sunlight Knowing what time of day it is Not looking like a pasty-white programmer/office worker Anyway, this post was an itch I've been meaning to scratch for a while to provide some closure and someone finally commented on it, so here goes... I used the chair for a few months.  (Feel free to take that sentence out of context.)  And it sort of worked.  It got me outside but I had several problems that I could never resolve to my satisfaction: 1)  The chair itself wasn't comfortable to sit in for an extended period of time.  I hate anything that provides so-called "back support".  As an intelligent alien lifeform on Earth (that's a joke, BTW), back "support" is more like back...

If you are like me, you dread adding multilingual support to applications.  It isn't that I do not like the various, rich cultures of our world, but rather that it is such a pain in the neck to implement multilingual support into an existing application from a programming perspective. One of the problems stems from the fact that nearly all programming languages are written in English and limited to the basic ASCII character set and targeted at English-speaking people.  Sure, I know of one programming language in Polish and a few others in other spoken languages but non-English programming languages are few and far between.  It really has nothing to do with America vs. whoever but more to do with settling on something we can use to get work done on a computer and English happens to fit nicely into a single byte (or less) and seems to be one of a handful of what I call "common trade languages" - that is, if you want to conduct business across international borders, it hel...

I was looking for some information on some high-performance MySQL questions lurking around in the back of my mind and found this very useful slideshow: How to Kill Mysql Performance On slide 40, there is a fairly complex and nearly unreadable (without going full screen) MySQL query that finds "useless" MySQL indexes by analyzing their cardinality .  Since it is not able to be copy-and-pasted, I figure I'll save someone the trouble.  It has been slightly modified for average data sets and to fix a case-sensitive bug: SELECT t.TABLE_SCHEMA, t.TABLE_NAME, s.INDEX_NAME, s.COLUMN_NAME, s.SEQ_IN_INDEX, (SELECT MAX(SEQ_IN_INDEX) FROM information_schema.STATISTICS AS s2 WHERE s.TABLE_SCHEMA = s2.TABLE_SCHEMA AND s.TABLE_NAME = s2.TABLE_NAME AND s.INDEX_NAME = s2.INDEX_NAME) AS `COLS_IN_INDEX`, s.CARDINALITY, t.TABLE_ROWS AS `ROWS`, ROUND(((s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) * 100), 2) AS `SEL %` FROM information_schema.STATISTICS AS s INNER JOIN informati...

When I visit websites that want me to create an account before doing something, I typically enter in bogus information and occasionally I see a "password meter" that determines that I've entered a "weak" password.  At least it is considered "weak" by some systems and "average/strong" in others.  Being the curious sort of person, I've been trying to come up with a good, consistent strategy for calculating password strength and then something useful to do with it.  I assume most developers only want to write password strength code one time, do something useful with it, and then move onto the next task. What constitutes a strong password?  An excellent question and something the industry seems to have difficulties figuring out at the moment.  NIST, the National Institute of Standards and Technology, has a few words to say on the topic.  Basically, password strength boils down to the number of bits of entropy that a password has. So the n...

I recently implemented a new feature called Cache Profiles into Barebones CMS . I'm a bit stuck on the documentation because I've had to stop and figure out how I'm going to create a mobile-friendly version of the website. I eat my own dog food after all. Om nom nom. The concept of a "mobile-friendly website" is foreign to some people. A lot of people think, "Our main website displays the exact same on the desktop, iOS, Android, etc. and therefore it is mobile!" That is NOT a mobile-friendly website. If a user has to use pinch-to-zoom or scroll horizontally at all to read the content, you have a desktop-only website. While desktop websites do display on most modern mobile devices, they are NOT mobile-friendly and users will hate you. Actually, that is a pretty good definition of a mobile-friendly website: "A mobile-friendly website is one that displays on small screens such as smartphones, scrolls only in the vertical direction, and is...

I've come to the inescapable conclusion that multiselect list boxes are not an intuitive UI element and are actually quite frustrating to use for most users. A set of two-state checkboxes is much more intuitive. In fact, I've found that anywhere that multiselect list boxes can be used, two-state checkboxes can easily replace them for a much more intuitive solution. Here's an example of a multiselect list box: Set the average user in front of a computer screen and ask him to deselect all selected items. The secret is to hold the 'Ctrl' key while clicking, but how often do people actually execute a 'Ctrl + click'? Not very often. Most users, in fact, aren't even aware of special key + click combos. These things are put into applications for power users AFTER the basic functionality is implemented. All functionality of a UI element should be available through a left click or a right click. This is User Interface Design 101. The multiselect li...

I and many other people have been waiting for a decade for this, but truly free SSL certificates with a root certificate installed in every browser is finally available. It used to be that to get a signed cert, you had to shell out tons of money. That was and is a ripoff. SSL certs cost ISPs nothing to produce and are pure profit. Even the EV validated certs (green bar) are a huge ripoff - sure the setup fee might make some sense where they do real checking, but, after that, the renewal process is entirely automated. Some places want $400 per certificate per year. This is one of the hosting/reseller industry's best-kept secrets. I've been keeping a very close eye on the free SSL certificate market for a while now. Every couple of months for the past decade, I've run a search query like "free SSL cert" and looked carefully at the results. The first organization that popped up on my radar was CACert.org . It was exciting when I first saw this because it ...

Ever since "Google Instant" was released by Google, the search box occasionally just disappears in Firefox: This seems to happen right around the moment when Google Instant directs Firefox to a new URL and I happen to be pressing the back button on my Logitech G500 Mouse . Which is, by the way, a very nice mouse for gaming and general-purpose use for us right-handed folks. Left-handed folks are, unfortunately, so neglected by computer equipment manufacturers. Anyway, I'm not sure why this bug happens. There is also another annoying bug with Google Instant that happens when I'm typing quickly. It switches from the main page to the Google Instant page. The search box is there with my search but complete search results refuse to show up and clicking the search button does nothing. Starting over and running the exact same search causes search results to show up. Google is one of those companies that doesn't publish their e-mail addresses anywhere. I do...

I've been using Windows for a really long time. As have many other geeks/nerds. I've seen my share of "Registry Cleaners", speedup tools, and tips from other people. All these things don't work. They really don't. You might get a temporary "boost" in certain areas, but a month later you'll be experiencing enough seemingly unrelated system problems that you'll end up reinstalling Windows. People always tell me their computers are slow and want to know how to speed it up. Today, I'm going to show you two ways to truly speed up a Windows-based computer and keep it lightning fast. First, fire up that slow computer and launch Task Manager. Go to the "Performance" tab, and look at the amount of memory being used. If the amount of memory being used exceeds 80% of the amount of available physical RAM, that means that portions of the OS and other programs are being moved to what is known as "swap space". Swap space...

It used to be, in order to have your own dedicated host, you had to plop down hundreds of dollars a month. Today, I noticed that 1and1 has a fantastic deal on dedicated hosting for $60/month on a permanent basis - this is not one of those 6 month deals. Cloud hosting and virtual hosting are, in my opinion, no longer competitive with this deal. I use dedicated hosting myself and absolutely love it. Most people opt for shared hosting, which introduces them to a world of hurt. If you have multiple websites, shared hosting gets expensive really fast. Plus shared hosting has significant downsides: - No control of the server. You are at the mercy of the hosting provider and their settings. - Web hosts cram hundreds, possibly thousands of websites onto a single box. Your website is not alone. - Greater risk at getting hacked because someone else on the same box got hacked. - You risk getting kicked off the hosting provider due to "too much CPU, RAM, or other resour...

For the past couple of weeks, I've been trying to get my domains unblocked from Hotmail/Live. I set up a new domain for Barebones CMS ( barebonescms.com ) and put forums on the site and forgot to add a SPF record for the domain. A couple weeks ago, Hotmail/Live servers decided that e-mail from barebonescms.com was invalid and therefore refused delivery. Due to the holidays being crazy, I was unable to get around to dealing with the problem. Then I discovered that Hotmail/Live was actually blocking ALL e-mail from my e-mail server regardless of domain. This sent me on a search to see how I could get unblocked. Of course, the first step was to fix my DNS records to add a SPF record. SPF-aware mail servers should really be assuming a default of: v=spf1 mx -all Or: v=spf1 a mx -all That way, most of us don't have to fiddle with silly things like this. The next two steps to getting off the Hotmail/Live block list is to go here: https://support.msn.com/ And requ...

Update February 27, 2011 - Windows 7 Service Pack 1 appeared in my update queue with the checkbox unchecked. Hmm. To update or not to update? Update January 14, 2011 - This appeared again in my Windows Updates. I figure installing it is okay now that Microsoft appears to have their ducks in a row. After the first fiasco, they probably took their time to release it correctly. This is the precursor to installing Windows 7 SP1. From Microsoft's website: "Windows 7 SP1 Release-to-Manufacturing (RTM) will be available in the first half of calendar year 2011. When released, it will be made available as an integrated release." This updates the installer in Windows 7 so it can upgrade to SP1 later. SP1 isn't available yet. What follows is the original post. Today, a mysterious Windows Update was released to all Windows 7 users. I'm going to preface this by saying what some Microsoft MVPs are saying: DO NOT INSTALL! The update says, "Install this ...

If you are building or using an e-commerce system and want to look all professional, you need invoice numbers. Invoice numbers are required, at the very least, for auditing purposes by most businesses. However, nothing says "not professional" quite like "dressing in a shirt that is flashier than a light pinstripe" or invoice numbers based solely on a MySQL 'auto_increment' field starting at '1' or, worse, a false arbitrary starting value. Searching Google for an industry-standard practice of creating an invoice number turns up pathetic results. So this blog entry aims to correct this severe oversight of the Internet and bring it down to the level of the average programmer. Businesses that are large enough have dedicated finance departments. These people like things to be EXTREMELY organized. If you are developing an application that is going to bring in money (e.g. an e-commerce solution), it needs to generate sequential orders that can be verif...

While developing my latest PHP-based project, WebCron , I ran into an issue that has bothered me for a while - atomicity. An atomic operation is one where only one thread of one process is allowed to execute some piece of code. Actually, even under C/C++, I've been bothered by this issue. Unlike Linux, Windows really has the most friendly approach to creating an environment where atomic operations may thrive. Named mutexes is one area where Windows really, truly shines above all the OSes out there. Try porting CreateMutex () to another OS and you'll inevitably have some real head-scratching sessions when you try to do a cross-process, named mutex. So-called 'mutexes' under *NIX OSes are usually ' pthread '-based, which are really more in line with Windows " critical sections " than "mutexes". A programmer coming from the Windows world is going to be utterly confused because they've been pampered by Microsoft and no one in the Linux ...

A couple days ago, I documented my recent experience with my wireless network and how I got hacked . I briefly mentioned that I'm installing Windows 7 this time around. Yesterday, I ran into an issue with 32-bit Apache 2.2.15 running on Windows 7 Ultimate 64-bit. This issue appears to only affect 64-bit Windows 7 and 64-bit Windows Vista web developers attempting to run 32-bit Apache on the system. NOTE: I didn't test 64-bit Apache because that is experimental and 64-bit PHP is even more experimental. However, I doubt the results would be too different. The issue is slow response times (anywhere from 1 to 3 seconds per request) when connecting to 'http://localhost/'. Connecting to 'http://127.0.0.1/' and 'http://[NetBIOScomputernamegoeshere]/' have fast response times. I've seen various fixes around that seem to boil down to these three: - Disable the Windows Firewall. - Disable IPv6 support. - Edit the 'hosts' file. It look...

Edit (July 6, 2013): It has taken me almost three (3) years to come up with a secure WiFi solution since I first wrote and published this article. It is my professional and personal opinion that, outside of running 200 ft. of Ethernet (which I actually did), only a WPA2-Enterprise AES w/ EAP+TLS setup is secure . My hope is that you come to the realization that your own WiFi network is not secure as you read my story below. I take security VERY seriously and violations of that security even more seriously. Hacking my personal networking infrastructure is near impossible. Or so I thought. First, some background. I run...well, I used to run a wireless network access point. Yes, it is one of those consumer-grade, wireless network setups because I'm a cheapskate. The brand doesn't matter. Here's the critical bit of information: I ran the wireless access point with WPA-PSK (TKIP) using a completely random key of about 40 characters in length and a different SSID fr...

In the field of Internet development - ICANN and Network Solutions/Verisign are eyesores. There is a very unhealthy relationship between the two organizations and ICANN holds a monopoly on the Internet as a whole by holding the domain name infrastructure hostage. On July 1, 2010, a price hike for .COM and .NET domain names will take place (VeriSign is the sole registrar for those TLDs). That means it will cost more to purchase and maintain those type of domain names. The core problem is the Domain Name System (DNS) as a whole. It was designed in the dark ages of the Internet by a bunch of nerds to map a name to an IP address. It was wholly owned by InterNIC, now known as ICANN through various transactions - or at least that is the best I can explain it in a single sentence. The original Internet (ARPANET) was designed to supposedly be robust in the event of nuclear war and people like it for its supposed anonymity. Basically, the Internet was a United States Department of Defense...