<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title>{ Simplic.IT } - Blog</title>
    <description>Thoughts on webdevelopment and security</description>
    <link>http://simplic.it/blog</link>
    <item>
      <title>On Browsers -- flamewar?</title>
      <description>
        <![CDATA[<p>I read f055's "<a href="http://f055.net/article/google-phasing-out-support-for-internet-explorer-6.0-and-what-does-it-mean/">Google phasing out support for Internet Explorer 6.0 and what does it mean?</a>" today and started to reply. As I went allong it became somewhat of a blog post. So this is the reply.</p>  <p>I think ignorance is the greatest factor in keeping IE6 around. When you put an icon of a globe with the word 'Internet' below on the middle of an otherwise clean desktop everybody will use that for browsing the internet.<br /><br />People dont care what their browser is (only webdevelopers and the <a href="/blog/view/on_browsers">[...]</a>]]>
      </description>
      <content:encoded>
        <![CDATA[<p>I read f055's "<a href="http://f055.net/article/google-phasing-out-support-for-internet-explorer-6.0-and-what-does-it-mean/">Google phasing out support for Internet Explorer 6.0 and what does it mean?</a>" today and started to reply. As I went allong it became somewhat of a blog post. So this is the reply.</p>
<p>I think ignorance is the greatest factor in keeping IE6 around. When you put an icon of a globe with the word 'Internet' below on the middle of an otherwise clean desktop everybody will use that for browsing the internet.<br /><br />People dont care what their browser is (only webdevelopers and the otherwise enlightened do) as long as they can access the intertubes, twitter, watch videos, order stuffs and do their banking they are fine. In their minds there is no such thing as an insecure / incompatible browser, and if any browser would be insecure it would be most certainly from the otherwise unknown Mozilla Foundation. The fact that things misrender goes right pass them as they have nothing to compare it with.<br /><br />I cry a little everytime I see one of those big billboards next to the road advertising Chrome. Not because it's chrome but because formentioned foundation just doesn't have the funds to put up this kind of advertising. If they had they would already be dominating. It is, all in all, a small miracle that they have a 28.xx% share of the market.</p>
<p>And the huge share of IE stems from the corporate world off course. The most major organisations I know have IE 6 as their default browser so "You must make sure it works on that to!". If you have spent hundreds of euros on obtaining your MSC*** you have a) been brainwashed and b) are not going to advertise Firefox as a good/safe/standards-adhering alternative.</p>
<p>All that aside, I agree with Google to phase out support for IE6. The web proffesionals should be able to expect some adhering to standards and IE6 adheres to none. I know Google can't be phasing out the entire Microsoft Browser Soup but I would just love to see Microsoft withdraw from the browser wars and let dedicated corporations or foundations have their go at it.</p>
<p>Here is why:</p>
<p>Back in the day (gosh I sound old now...) we webdevelopers hacked in exceptions for all the browsers. There where standards (w3c provided them) but there was no browser to adhere to all the standards. No browser was standard. Today we have to hack in exceptions for IE only. And every major version of IE needs it own hacks.</p>]]>
      </content:encoded>
      <pubDate>Tue, 02 Feb 2010 09:01:19 +0100</pubDate>
      <link>http://simplic.it/blog/view/on_browsers</link>
    </item>
    <item>
      <title>Get connected -- find your true connection with rails</title>
      <description>
        <![CDATA[<p>In Rails, the database connection hides behind an adapter. This adapter allows you to execute queries, but you cannot bind variables in a safe manner where the database driver does the escaping for you. Not something you want in a web-application where SQL injection should be on the top of your list of concerns.</p>  <p>Here's a little snippet of code to put in <code>lib/adapter_connection.rb</code> of your <code>RAILS_ROOT</code> to be able to obtain the true connection and start binding and escaping.</p> <a href="/blog/view/get_connected">[...]</a>]]>
      </description>
      <content:encoded>
        <![CDATA[<p>In Rails, the database connection hides behind an adapter. This adapter allows you to execute queries, but you cannot bind variables in a safe manner where the database driver does the escaping for you. Not something you want in a web-application where SQL injection should be on the top of your list of concerns.</p>
<p>Here's a little snippet of code to put in <code>lib/adapter_connection.rb</code> of your <code>RAILS_ROOT</code> to be able to obtain the true connection and start binding and escaping.</p>
<pre><code># this will grant access to the true database connection which is hidden
# in the current ConnectionAdapter.
#
module AdapterConnection
  def get_true_connection
    adapter = ActiveRecord::Base.connection

    # when we cannot get the TRUE connection yet, make it so
    unless adapter.respond_to?(:get_connection)
      klass = adapter.class
      klass.class_eval do
        def get_connection
          @connection
        end
      end
    end

    # return the TRUE connection
    adapter.get_connection
  end
end</code></pre>
<p>&nbsp;</p>
<p>Be aware that the way binding occurs differs for different database drivers so you should be pretty sure this is the only way, since it isn't very portable!</p>
<p>Now in your model you would want to add the following lines of code:</p>
<pre><code>class MyModel &lt;&lt; ActiveRecord::Base

  include AdapterConnection

  def my_tailored_query
    conn = get_true_connection
    # ...
  end
end
</code></pre>]]>
      </content:encoded>
      <pubDate>Wed, 30 Dec 2009 08:06:07 +0100</pubDate>
      <link>http://simplic.it/blog/view/get_connected</link>
    </item>
    <item>
      <title>Effigy -- brilliant plan needs work</title>
      <description>
        <![CDATA[<p>I was browsing through my lost tweets and found <a href="http://twitter.com/mojombo/status/6916459916">this tweet by Mojombo</a>, promoting <a href="http://github.com/jferris/effigy">this wonderful idea called Effigy</a>.</p>  <p>I am wonderfully amazed by the simplicity of the concept and wonder why I it hasn't been done before (although <a href="http://wicket.apache.org/">Wicket</a> does something similar). It gives true power to the View as seen as part of an MVC framework. The view tends to clutter with Control stuffs, but Effigy might have a good chance of stopping that.</p>  <p>I had to try it immediatly; and hooray! It works!</p> <a href="/blog/view/effigy">[...]</a>]]>
      </description>
      <content:encoded>
        <![CDATA[<p>I was browsing through my lost tweets and found <a href="http://twitter.com/mojombo/status/6916459916">this tweet by Mojombo</a>, promoting <a href="http://github.com/jferris/effigy">this wonderful idea called Effigy</a>.</p>
<p>I am wonderfully amazed by the simplicity of the concept and wonder why I it hasn't been done before (although <a href="http://wicket.apache.org/">Wicket</a> does something similar). It gives true power to the View as seen as part of an MVC framework. The view tends to clutter with Control stuffs, but Effigy might have a good chance of stopping that.</p>
<p>I had to try it immediatly; and hooray! It works!</p>
<p>(what the docs of Effigy don't mention is that you need to add</p>
<pre><code>  config.gem "effigy"</code></pre>
<p><br /> to you config/environment.rb, but that was quickly figures out)</p>
<p>&nbsp;</p>
<p>I wondered how Effigy would work with the Rails Helpers, so I tried the following:</p>
<pre><code>class FooIndexView &lt; Effigy::Rails::View 
  def transform 
    text('h1', @title) 
    attr( 
        'a#menu', 
        :href =&gt; ActionView::Helpers::UrlHelper.url_for( { :controller =&gt; 'foo', :action =&gt; 'index' } ) 
    ) 
  end
end</code></pre>
<p>Doesn't work-station. Effigy interferes and somehow ActionView::Helpers::UrlHelper does not contain 'url_for' according to ruby. But when I second guess that on <code>script/console</code> like this:</p>
<pre><code>&gt;&gt; ActionView::Helpers::UrlHelper.instance_methods.include? "url_for"
=&gt; true</code></pre>
<p>And when I peek in the url_helper.rb it quite clearly states that there is a <code>def url_for(options = {})</code>.</p>
<p>Why this isn't working is beyond me, but I will be looking in to it. When I find something, I'll leave a comment (and if you have the solution, please let me know).</p>
<p>So there is some work to do for <a href="http://github.com/jferris">jferis</a> and his Effigy; because the loss of the ActionView::Helpers is somewhat unbearable (for me @ least)</p>
<p>Apart from that, getting stuff like observe_field() and such in seems a challenge. Perhaps Effigy should allow the use of ERb as a template (Checked it, doesn't work). This would allow the helpers to work and to have a specialized view mechanism for stuffs that tend to end-up in the controller, because there is also logic that needs be in the view.</p>
<p>I forked Effigy on github and when I find the time I will try to get this plan together</p>]]>
      </content:encoded>
      <pubDate>Tue, 22 Dec 2009 12:21:16 +0100</pubDate>
      <link>http://simplic.it/blog/view/effigy</link>
    </item>
    <item>
      <title>Oracle to consume MySQL -- ... there is hope, is there?</title>
      <description>
        <![CDATA[<p>This morning a tweet alerted me to the fact that Oracle is to acquire Sun and with it MySQL. It led to the blog of Monty (Micheal Widenius, creator of MySQL) where a doom scenario is laid out for the future of MySQL.</p>  <p>It explains how Oracle has been proven unworthy of OpenSource projects by the way they have treated InnoDB and it also explains that the European Commission (EC) has second thoughts about the deal.</p> <a href="/blog/view/oracle_to_consume_mysql">[...]</a>]]>
      </description>
      <content:encoded>
        <![CDATA[<p>This morning a tweet alerted me to the fact that Oracle is to acquire Sun and with it MySQL. It led to the blog of Monty (Micheal Widenius, creator of MySQL) where a doom scenario is laid out for the future of MySQL.</p>
<p>It explains how Oracle has been proven unworthy of OpenSource projects by the way they have treated InnoDB and it also explains that the European Commission (EC) has second thoughts about the deal.</p>
<p>So Monty pleads to send a letter to the EC and ask it to have it force Oracle to</p>
<ul>
<li>exclude MySQL from the deal</li>
<li>be a valid OpenSource stewart</li>
</ul>
<p>You can find a examplatory petition in <a href="http://monty-says.blogspot.com/2009/12/help-saving-mysql.html" target="_blank">the original blog post of Monty</a>. Find it, fill it in and send it to Brussels.  In the name of Open Source, free software and great tools; Thank you.</p>]]>
      </content:encoded>
      <pubDate>Mon, 14 Dec 2009 08:27:24 +0100</pubDate>
      <link>http://simplic.it/blog/view/oracle_to_consume_mysql</link>
    </item>
    <item>
      <title>Playfull morning -- Thomas, rails and git</title>
      <description>
        <![CDATA[<p>Was out early this morning (or rather the kids where up and it was Jenny's turn to keep the bed warm) and as they where multitasking between playing and watching Thomas the Tank Engine and Friends I was having a critical second look at the new me (or rather the business presentation of me called website).</p>  <p>I fixed some stuff (see <a href="http://github.com/coffeeaddict/simplic.it/commits/master">http://github.com/coffeeaddict/simplic.it/commits/master</a>) and am still amazed with the ease the Rails run.</p> <a href="/blog/view/playfull_morning">[...]</a>]]>
      </description>
      <content:encoded>
        <![CDATA[<p>Was out early this morning (or rather the kids where up and it was Jenny's turn to keep the bed warm) and as they where multitasking between playing and watching Thomas the Tank Engine and Friends I was having a critical second look at the new me (or rather the business presentation of me called website).</p>
<p>I fixed some stuff (see <a href="http://github.com/coffeeaddict/simplic.it/commits/master">http://github.com/coffeeaddict/simplic.it/commits/master</a>) and am still amazed with the ease the Rails run.</p>
<p>Obviously I had to divide my attention between the x-term and my kids but I had my improvements in no time. Despite the fact that I had to go and look at the big adventures of Thomas a dozen or so times...</p>
<p>The work I did with git at <a href="http://www.2organize.nl">2organize</a> has made me even more comfortable with it and I seem to be able to get around with no errors now ;-).  My git/tier setup is like this</p>
<pre><code>
  [ github ]  &lt;- origin -  [ simplic.it ]  (RAILS_ENV = production)
                             /\      |
                              |     dev
                            origin   |        
                              |      \/
                           [ dev.simplic.it ]

</code></pre>
<p>I develop on dev.simplic.it, pull my fixes from dev/master in simplic.it and then push to origin (being github). This ensures I have only production ready code on github (not that it matters for simplic.it) and I like the workflow it gives me.</p>
<p>Still hope to find a workplace where git is the leading SCM because I firmly believe in the power of git over subversion or CVS. Come to think of it, I hope to find a workplace... As my current assignment over at 2organize is due to end along with the present year.</p>]]>
      </content:encoded>
      <pubDate>Sat, 12 Dec 2009 09:13:32 +0100</pubDate>
      <link>http://simplic.it/blog/view/playfull_morning</link>
    </item>
    <item>
      <title>Easy Auth -- Make authentication simple</title>
      <description>
        <![CDATA[<p>...that was the goal.</p>  <p>I had a glance over at <a href="http://www.themomorohoax.com/2009/02/21/rails-2-3-authentication-comparison">this lil' comparison</a> when I was looking for a good authentication plugin (I like plugins, they save me code writing) and I gloomed.</p>  <p>All I wanted was something to authenticate a user with. Something that has knowledge of a username and password and can combine the two together so that you can say; "That girl at the other end is Alice after all".</p> <a href="/blog/view/easy_auth">[...]</a>]]>
      </description>
      <content:encoded>
        <![CDATA[<p>...that was the goal.</p>
<p>I had a glance over at <a href="http://www.themomorohoax.com/2009/02/21/rails-2-3-authentication-comparison">this lil' comparison</a> when I was looking for a good authentication plugin (I like plugins, they save me code writing) and I gloomed.</p>
<p>All I wanted was something to authenticate a user with. Something that has knowledge of a username and password and can combine the two together so that you can say; "That girl at the other end is Alice after all".</p>
<p>And I wanted a mechanism to do authorization so that I could grant Bob access here and deny that same access to Alice. The granularity of the authorization I needed was 'user' and 'admin'. Blunt, effective and useful :-)  I choose to use <a href="http://github.com/platform45/easy_roles">easy_roles</a> for that. Although I think the serialized array could have been better done, it served my purposes.</p>
<p>But I still had no authentication framework. So I stumbed out my own plugin using the methods of authentication I have used many times before. There is a user, a password and some salt. Mix the password and the salt to have some sort of security in your database and search the user by his username and salted version of the supplied password.If you can find something, the user is authentic (or has stolen the username and password, but then the owner is an ass so I couldn't care less)  The salt is added in the config/environment.rb like so:</p>
<pre><code>  EASY_AUTH_SALT = '# the output of rake secret here #'
</code></pre>
<p>I wanted the users of the plugin to have control over the model they would choose as their user model. I would call it User, but names like Role or WebUser are not unthinkable so I made the plugin hookup on request. This is done by calling the acts_as_authentic method.</p>
<pre><code>  class User &lt; ActiveRecord::Base
    acts_as_authentic
  end
</code></pre>
<p>This will do a number of things for the User model.</p>
<ul>
<li>It will add 2 accessors, namely 'password_confirm' and 'new_password' so the user can confirm his first and later passwords</li>
<li>It will add a class method called authenticate which takes the username and a password as its argument and will perform a find for you. Returning the user object or nil</li>
<li>It will add a class method called hashed_password which you can feed a string which will then be salted and hex'ed and returned</li>
</ul>
<p>For the integration with easy_roles (and perhaps others) I wanted my Rails apps to have a 'current_user'.  But is it always necessary to have a current user? r is it perhaps only necessary in shielded parts of your app? You get to decide by nominating a controller as an authenticator by using 'acts_as_authenticator_for' and specifying the model that is to be the current user.</p>
<pre><code>  class AdminController &lt; ApplicationController
    acts_as_authenticator_for User
  end
</code></pre>
<p>All the things you need like: reset password, signup, login &amp; logout are left as an exercise for the developer. You may have needs I don't know about.</p>]]>
      </content:encoded>
      <pubDate>Thu, 10 Dec 2009 21:17:26 +0100</pubDate>
      <link>http://simplic.it/blog/view/easy_auth</link>
    </item>
    <item>
      <title>One Train Working -- stop the intermittent InvalidAuthToken error!</title>
      <description>
        <![CDATA[<p>I can't figure out why the Rails core team hasn't fixed this yet...</p>  <p>The form_authentication_token is composed of Base64 and it kills some Internet Explorer non-Browsers when the Base64 contains '=', '+' or '/' (which happens with Base64 sometimes).</p>  <p>The token is generated using <a href="http://railsapi.com/doc/rails-v2.3.5/classes/ActiveSupport/SecureRandom.html">ActiveSupport::SecureRandom</a>. It hands out a method called base64(). And, here is the surprise, it also hands out a method called hex(). Why the core team hasn't changed the base64(32) to hex(32) some odd releases of Rails ago is beyond me.</p> <a href="/blog/view/one_train_working">[...]</a>]]>
      </description>
      <content:encoded>
        <![CDATA[<p>I can't figure out why the Rails core team hasn't fixed this yet...</p>
<p>The form_authentication_token is composed of Base64 and it kills some Internet Explorer non-Browsers when the Base64 contains '=', '+' or '/' (which happens with Base64 sometimes).</p>
<p>The token is generated using <a href="http://railsapi.com/doc/rails-v2.3.5/classes/ActiveSupport/SecureRandom.html">ActiveSupport::SecureRandom</a>. It hands out a method called base64(). And, here is the surprise, it also hands out a method called hex(). Why the core team hasn't changed the base64(32) to hex(32) some odd releases of Rails ago is beyond me.</p>
<p>So there is a plugin (by me) that does it for you: http://github.com/coffeeaddict/one_train_working</p>
<p>Finding a sound name wasn't easy, it took some reading of the almighty wikipedia, but I have <a href="http://en.wikipedia.org/wiki/Token_(railway_signalling)#Token_only">found this</a>.</p>]]>
      </content:encoded>
      <pubDate>Fri, 11 Dec 2009 13:43:01 +0100</pubDate>
      <link>http://simplic.it/blog/view/one_train_working</link>
    </item>
    <item>
      <title>Time for a tech blog</title>
      <description>
        <![CDATA[<p>I wrote on my <a href="http://coffeeaddict.nl/blog/">personal blog</a>, which gets heavily abused for tech stuff, it was time for a tech blog.  I wrote that about a year ago.</p>  <p>So, I guess now is the time for a tech blog.  Rolled my own (as I do with my cigarettes) as I needed less then anything and wanted to do it with Rails (As I love Ruby and like to write code).</p> <a href="/blog/view/time_for_a_tech_blog">[...]</a>]]>
      </description>
      <content:encoded>
        <![CDATA[<p>I wrote on my <a href="http://coffeeaddict.nl/blog/">personal blog</a>, which gets heavily abused for tech stuff, it was time for a tech blog.  I wrote that about a year ago.</p>
<p>So, I guess now is the time for a tech blog.  Rolled my own (as I do with my cigarettes) as I needed less then anything and wanted to do it with Rails (As I love Ruby and like to write code).</p>
<p>You are looking @ it now. Have a peek over on <a href="http://github.com/coffeeaddict/simplic.it">github</a> to see how it is done (The coolest features are, as always, only available to those that are enabled - it does dragging and dropping of tags and such).</p>
<p>I hope to enlighten you with my tech scribbles real soon so I can unload my private WordPress blog.</p>]]>
      </content:encoded>
      <pubDate>Fri, 13 Nov 2009 08:09:05 +0100</pubDate>
      <link>http://simplic.it/blog/view/time_for_a_tech_blog</link>
    </item>
  </channel>
</rss>
