I have done quite a bit of reading on color over the years, but proportion is something I really don't know much about. Was just watching a pretty cool presentation (Design for the coders mind), where the presenter talked about how he likes to use 3/4 proportion, and basically just starts from a pt size and works his way up when choosing font sizes for websites. I thought that was a great idea, and banged out a quick ruby script to do it for me

# Calculates a collection of points in the same propotion
# defaults to 3/4, as suggested here  
# http://www.slideshare.net/kadavy/design-for-the-coders-mind-reverseengineering-visual-design-presentation

PROPORTION = 0.75

n = ARGV[0] || 10
start = ARGV[1] || 7

pt = start * PROPORTION
n.times do
  pt = (pt / PROPORTION).round
  puts pt
end

So it's been about a month and a half now since I started using ruby and rails professionally. While its been hard work getting up to speed on the domain of contract packaging, while getting up to speed on ruby, and learning vim, it is also just a joy after working with java and c# for so long.

One of the cool things about pair programming is you pick up peoples tricks and styles very quickly. Here is a quick list of some of my favorite ruby and rails tricks I have learned over the last month and a half.

1) Checking if a variable is one of many things

This has been a pet peeve of mine for a long time now.

if (variableName == "option1" || 
    variableName == "option2" || 
    variableName == "option3") 
{ 
  //do stuff 
}

I always felt that was a failure in language design, not even remotely DRY. Awhile back I tried this in ruby, because I knew that the or operator was way more powerful then in c#, but it totally doesn't do what I was hoping

if variable_name == ("option1" || "option2" || "option3")

All that will do is the stuff in the parens will evaluate to "option1", since the boolean value of a string is true. What I was looking for was this

["option1", "option2", "option3"].include? variable_name

A bit nicer version of that would be to use the word array syntax

%w{ option1 option2 option3 }.include? variable_name

2) try, omfg I love you

So in c#, probably a fifth of your code is null checking in some form or another. Things like this are pretty normal

Class2Name obj = Class1Name.DoSomething();
if (obj 
{
    obj.DoSomethingElse();
}

In ruby (with active support), you would do something like this

ModName.do_something.try(:do_something_else)

What that will do, is if do_something returns nil, the call to try will return nil. If it isn't, the try basically works the same way as a send.

This is a prime example of the lisp philosophy, that if you make a language powerful enough, libraries can implement language features.

3) alias_method_chain, just a better way to do it

There is a method called alias_method that takes two symbols, the first being a new method name, the second being an existing method name. What this does is the equivilent of a unix hard link, it will have two method names pointing to the same method. That way you can re=define one of them, and the old one sticks around. We have a concept called 'alias method chaining', where what we want to do is add a pre or post hook to a method that doesn't have one. It usually looks something like this

alias_method :old_foo, :foo
def foo
  puts 'this is redefined'
  old_foo
end

This works great... until the next guy walks in and does the same thing in a different place. Your re=defd foo becomes old_foo, crushing the origional foo. His foo calls your foo, which calls itself, blows the stack, and you have a mysterious stack overflow exception that is exceptionally difficult to debug.

To get around this, rails has a method called alias_method_chain. What this does is takes two arguments, the first is the method, the second is a unique name for what you want to do with the method. alias_method_chain will first alias the method to method_name_without_second_arg. then it will alias the origional method to method_name_with_second_arg that you are responsible for defining. An example would look like this

def foo_with_hack
  puts 'a bit of a safer way to handle things'
  foo_without_hack
end
alias_method_chain :foo, :hack

This has a few benefits. First, since you aren't aliasing the old one to something generic, there is a much lower chance someone will blow it away with their aliasing. Secondly, since you are aliasing your method to something with a unique name, the order of the chaining call has a better chance of staying in tact. Thirdly, it is much more clear what your intention is.

4) Handling an arg that may or may not be an array

Array has a method called flatten. What it does is turns any array into a single dimensional array. Here is an example in irb

irb(main):001:0> [[1, 2, 3], ['a', 'b', 'c']].flatten
=> [1, 2, 3, "a", "b", "c"]
irb(main):002:0> [1, 2, 3].flatten
=> [1, 2, 3]

Pretty cool, right? With a bit of creativity, we can use it like this

def foo bar
  [bar].flatten.each do |b|
    #do stuff
  end
end

So, if bar is an object, wrapping it in square brackets will make it an array, flatten won't do anything, and we iterate once. If bar is an array, wrapping it in square brackets will turn it into an array with a single element, which is the bar array. flatten effectively gets rid of that extra level, then we iterate over it.

When you are talking about security with regards to web applications, the vast majority of it falls into IT land (i.e. configuring your firewall, webserver, etc). However, that doesn't mean web application developers can just ignore security. The most pervasive, and difficult to understand attack vectors out there is Cross Site Scripting, or XSS for short.The idea is that you find a public facing web page that exposes user generated content automatically, but does not take measures to prevent people from injecting arbitrary html or javascript. On the face of it, you may think "Ok, so that would mean a page gets defaced. Sucks, but its not the end of the world". It turns out it could get much, much worse then that. Here is a quick rundown of several scenarios where an XSS vulnerability could cause serious harm

Straight Forward XSS

1. I find google has an xss vulnerability
2. I write a script that rewrites a public google page to look exactly like the actual google login
3. My fake page submits to a third party server, and then redirects back to the real page
4. I get google account passwords, users don't realize what happened, google doesn't know what happened

XSS as a platform for CSRF

1. Amazon has a csrf vulnerability where a "always keep me logged in" cookie allows you to flag an entry as offensive
2. I find an xss vulnerability on a high traffic site
3. I write a javascript that hits up the urls to mark all books written by gay/lesbian authors on amazon as offensive
4. To amazon, they are getting valid requests from real browsers with real auth cookies. All the books disappear off the site overnight
5. The internet freaks the hell out. (this supposedly actually happened)

XSS as a platform for Session Fixation attacks

1. I find an e-commerce site that does not reset their session after a login (like any asp.net site), have the ability to pass session id in via query string or via cookie, and stores auth info in the session (pretty common)
2. I find an XSS vulnerability on a page on that site
3. I write a script that sets the session ID to the one I control
4. Someone hits that page, and is bumped into my session.
5. They log in
6. I now have the ability to do anything I want as them, including buying products with saved cards

Those three are the big ones. The problem with XSS, CSRF, and Session Fixation attacks are that they are very, very hard to track down and fix, and are really simple to allow, especially if a developer doesn't know much about them.

So I am a big fan of the vimfiles that scrooloose put up on github. I cloned them awhile back, and used them as a base for my own setup.

One of the things he does is choose a theme based on the capabilities of the terminal. As soon as I installed ubuntu 10.04, I started getting this

E558: Terminal entry not found in terminfo
'gnome-256color' not known. Available builtin terminals are:
    builtin_gui
    builtin_riscos
    builtin_amiga
    builtin_beos-ansi
    builtin_ansi
    builtin_pcansi
    builtin_win32
    builtin_vt320
    builtin_vt52
    builtin_xterm
    builtin_iris-ansi
    builtin_debug
    builtin_dumb
defaulting to 'ansi'

The issue is that terminfo is set in a non standard way in ubuntu (no idea if this is a gnome issue or an ubuntu issue). Turns out, there is a quick fix

apt-get install ncurses-term

No idea why it works (honestly, I have already spent way too much time on this), but it does. Hopefully that helps someone :-) At the least, it will save me some googling next time I run into this issue...

So it has been awhile since I made any meaningful posts, but I have had a seriously full plate. I just got started as a developer for Nulogy, a very impressive startup in the packaging sector. This is a lot of firsts for me; it is the first time I have worked at an XP shop. It is the first time I have worked in rails and postgres, it is the first time to work with rails, and the first time using linux (and vim) as a dev environment.

Needless to say, starting a new job is exhausting, and starting a new job where there is so much to learn is even more of a challenge. It also feels great to never have to use ASP.net again ;-)

Anyways, Clojure is definitely on hold for the foreseeable future, and it may be another few weeks before I start picking up personal projects again. First priority is going deeper with ruby and rails, which I am really looking forward to. Already today, my mind was blown by the awesomeness that is rvm, but that is a topic for another post :-)

After a bit over two years of pushing for it, it feels fantastic to finally put this into our master page

<script language="javascript" type="text/javascript" src="/_scripts/jquery-1.4.2.min.js"></script>

This really is quality stuff. Check it out if you want a quick laugh

link

I have read the GoF Design Patterns book a few times now, it is one of those things where the more you read it, the more you get out of it. Most patterns in that book can be boiled down to a single principal "Delegate all related functionality as much as possible, and always code against the interface of that delegation, not the implementation." The first benefit of this is obvious, when you delegate out single responsibilities, that code becomes a lot more straight forward to read, and easier to reuse. The second part is a bit trickier, because it is something that can take awhile before you can be bitten by it.

Circles and Ellipses

There is a huge amount of emphasis on inheritance when there is any discussion on object orientation, even though it is probably the single worst thing about the paradigm.

The first comes from a pure modeling point of view, which is more widely known as the circle-ellipse problem. A circle is an ellipse with an additional constraint put on it, which makes it a classical "is-a" relationship. We are taught that as soon as we see that, we are talking about inheritance. So what happens when Ellipse has a stretchX method that mutates one axis but not another?

You have a few options. First, Circle could override stretchX, and raise an exception if it is called on Circle. This is a pretty ugly solution, and will be a huge gotcha in the API. Another possibility is that Circle could make stretchX mutate the Y axis at the same time. Our problem here is that it violates the Liskov Substitution Principal, which states that any subclass should be able to be swapped in for its base class without breaking the program. If we are working with an ellipse, and we call both the stretchX and stretchY methods, we will not end up with what we want.

When it comes to OO modeling, a circle is not an ellipse (just as a square is not a rectangle). You cannot use inheritance to effectively model a relationship where the subclass is a constrained version of the base class, even though the way we think of inheritance would lead us down that road.

Implicit Coupling

Let's say we are modeling some sort of car and truck registration system. We have a class called Vehicle, it has a method called start on it. start does things like flip an isStarted flag, does some logging, maybe stores data about fuel levels and whatnot. This works great while we continue with trucks and cars. But what happens when the system has to be expanded to include bicycles?

A bike doesn't have an engine, and starting a bike is a very different process then starting a car. Since we chose to leverage inheritance for code reuse, we are in a bit of a pickle, since we now have many subclasses that depend on specific implementation details of start. A refactoring of start means those changes will cascade down our inheritance hierarchy, and it will turn a minor job into a pain in the ass.

Using Composition

Lets say that when we were designing Vehicle, we saw there was a group of related functionality, and delegated out to an Engine interface. First of all, by the time we have a decent number of cars, the things that start touches will probably have to handle a few different cases. Having multiple Engine implementations will clean that up substantially. Secondly, when we have to implement our bike, all it takes is NoEngine implements Engine, and we move on to the next problem.

The more ways a class can be impacted by changes in related classes, the harder it is to maintain. By eliminating coupling, you end up reducing the amount of code you have to change when modifying the system, and also increase flexibility. Finally, compositional design is WAY easier to test then anything else.

When Inheritance is a Good Idea

Inheritance is a good idea when you are not talking about a constraint on a base class, when you are already behind a more complete level of abstraction, and when your subclass is basically the same as the super class with only a small behavioral change. So in our Vehicle case, maybe you have TruckEngine implements Engine, and the only difference between implementations are in terms of fuel consumption rate. Sure, there is a tight coupling, but in this case it will save us time down the road, since there is a very small chance that our changes will effect that one piece that is different.

Looking at inheritance in this fashion ends up dramatically reducing is usage in big systems, and becomes more used to get a job done it a quick, slightly hacky fashion, rather then the primary form of polymorphism and code reuse.

Oddly poetic, they were suspended due to "strange activity" http://twitter.com/scientology

ASP.net Membership was written to fill a big hole in the ASP.net 1.1 ecosystem - a lack of an authentication API. While that is a worthy goal, I don't think they implemented it as well as they could have.

Being Everything to Everyone

The API almost looks like someone ran down a checklist. It has to be RAD, because mort needs an easy system. It has to be extensible, because no two auth systems are the same. It has to have extensibility points, so that people can customize it. It has to plug into the myriad MS authentication technology for product synergy.

It has to be RAD

RAD is great for small project, the choice to configure the system using XML is questionable, but the idea that you have a fully featured system out of the box is a good one. The other great leap that they did was to assume that everyone is using SQL Server, so they (helpfully) implemented a great deal of logic in about 150 SQL Server specific sprocs. Thanks.

The problem with RAD tools, is what happens when you need to step outside the box? That leads us to

Extensibility

Ok, so people need to be able to create custom profile fields. If we didn't have the RAD constraint, we could just let the developers create their own profile model. Unfortunately, it has to be RAD, so to implement this, they created a colon seperated index and colon seperated value fields in the DB. Ok, but what about complex types? you ask. XML is the answer. Colon delimited XML blobs in the database. Pure awesome. But wait, there is more

So to recap, we now have:

• PropertyNames, which looks something like

FirstName:S:0:7:City:S:7:7:PostalCode:B:0:-1:Region:S:14:7:Country:S:21:2:PreviousSessionStartTime:S:23:81:LastName:S:104:7:CurrentSessionStartTime:S:111:90:

• PropertyValuesString, which looks like this

NameTorontoOntarioCA<?xml version="1.0" encoding="utf-16"?>
<dateTime>0001-01-01T00:00:00</dateTime>LastName<?xml version="1.0" encoding="utf-16"?>
<dateTime>2009-10-15T20:12:15.0513774Z</dateTime>

• PropertyValuesBinary, which is just a big binary blob

The profile data is officially obfuscated.

Extensibility Points

Apart from the paragon of software engineering that is the profile system, there is the Provider model, which is an implementation of the Abstract Factory Pattern, which is basically a factory of factories. Sounds enterprisey? Hells yeah.

Step one to implement your own, is to extend the base class, which has about 30 required methods on it and a Profile Provider with about 15 methods on it. Both have a whole bunch more optional ones (which are basically just stuff specific to the default providers). We know that using inheritance over composition leads to fragile code, due to how inheritance is a form of tight coupling, but MS apparently didn't get the memo. We also know that we shouldn't have God Interfaces, but should instead use multiple smaller interfaces to allow for fine grained implementations. Again, this idea was the furthest thing from the minds of the MS developers.

After you get that done, to use it you need to register about a billion different options in your xml based config file. To be fair, MS didn't invent programming via XML, but they sure are perpetuating it. Again, this comes back to the all things to all people mentality; what happens if I don't care about supporting multiple authentication environments in a single application? (probably the 99% use case) Doesn't matter, I still need to configure those settings.

MS Integration

This seems to be what everything was built towards. It is effortless to plug into anything from XML auth stores, to ActiveDirectory. While that is awesome, what about things that web applications outside of MS actually need? Like OAuth for example?

Fine smartypants, what would be a better way?

Let's take the excellent AuthLogic project. Instead of being a system that you have to integrate with, it is a system that integrates with you. You tell it that your user model is your user model, and it will look for specific fields (convention over configuration ftw

This is clean, it is simple, and it is WAY more extensible then the ASP way. The difference between the two is that instead of getting started instantly, and then banging your head against the wall later, you put a bit more work in at the beginning, and have something that will grow in whatever way you need it to.

Fine, but what about RAD???

That is a valid point, something like AuthLogic is overkill for situations where all you really need is username and password, and it wont really grow much passed that. Well, in rails we have something called restful_authentication, that will generate up a simple auth system for you with all the trimmings. Very little work, I would say less then actually configuring ASP.net Membership, and if things change down the road, you can customize the generated code in any way you need to.

At least Microsoft delivers something that frees me from thinking about security

Yeah. As long as you don't care about session fixation attacks, which MS is vulnerable to out of the box. MS knows about this, but has decided that instead of fixing it, they will put up a kb article that recommends every ASP.net page includes a 50 loc snippit to get around the issue.

Do people know about this? Of course not. I mentioned it a few times in team meetings, and passed articles around talking about how .net apps are vulnerable to that attack vector, but still heard people talking about the symptoms of a session attack only failing because our code is very rigid in a few places (exact quote Someone must just be using two different browsers as they go through the checkout process)

Conclusions

ASP.net membership is a poorly engineered API that is insecure out of the box, is not well maintained, and gives developers a false sense of security. Authentication is a weekend project if you aren't building a framework, but still, most .net developers blindly follow the official APIs, assuming that a major corporation like MS can put out something decent.

Ran into an issue where merges were getting corrupted for some reason, and adding a random garbage character to the end of some files. Whipping up a script that verifies the files is obviously the way to go in situations like that, and what I have been doing for years is using perl as a sort of glue language for unix command line utilities. As I get more comfortable with ruby, I find it is becoming more and more my weapon of choice in these situations.

There are three things that make a good "glue" language: great regex syntax, great file manipulation APIs, and great command line integration. Those three things were always my favorite things about perl, and thankfully, they have been copied over pretty much verbatim into ruby.

In this situation, I need to do a recursive search through a directory tree. Find does that in a pretty straightforward manner. Regex is great in ruby, using the =~ operator and standard regex syntax /pattern/, it will return the number of matches, or nil for nothing. Last piece is command line integration, anything inside of back ticks (`) will execute on the commandline, and then evaluate as the return value.

So, what we want to do is walk the source tree, look for source files (which should all end with >, since we are talking about xml-ish files), grab the last line, and make sure it ends with something valid (with a bit of experimentation, I found that for my site that meant >, space, tab, or newline)

What I ended up with is this

require 'find'

puts 'starting search....'
puts '-----'
Find.find(ARGV[0]) do |path| # walk the site tree
  Find.prune if File.basename(path) == '.svn' # don't go into svn folders

  if path =~ /(aspx|ascx|resx)$/ # only test aspx, ascx, or resx files
    last = `tail -1 "#{path}"` # call out to tail
    if last =~ /[^> \t\n]$/ # if it is not one of the safe characters
      puts path
      puts last
      puts '-----'
    end
  end
end
puts 'done.'

Very fast to write, very straight forward to read.

Ajaxian ran this incredible javascript quiz today. Really delves deep into javscript arcana, without really going into language bugs or anything like that.

Link

Really cool post by Lau Jensen on using clojure/compojure to replicate reddit. This dude is pretty much the only guy on the internet talking about using clojure for the web, I really hope he keeps going with these tutorial style posts

link

"the greatest single programming language ever designed"

- Alan Kay, on Lisp

"Greenspun's Tenth Rule of Programming: any sufficiently complicated C or Fortran program contains an ad hoc informally-specified bug-ridden slow implementation of half of Common Lisp."

- Philip Greenspun

"Lisp is worth learning for the profound enlightenment experience you will have when you finally get it; that experience will make you a better programmer for the rest of your days, even if you never actually use Lisp itself a lot."

- Eric Raymond, "How to Become a Hacker"

"Lisp has jokingly been called "the most intelligent way to misuse a computer". I think that description is a great compliment because it transmits the full flavor of liberation: it has assisted a number of our most gifted fellow humans in thinking previously impossible thoughts."

- Edsger Dijkstra, CACM, 15:10

As a relatively young developer who didn't go the whole university route, one of the things that I have always felt was lacking from not doing the CS thing was an understand of Lisp. When most of the greatest hackers of all time speak about a language in revered tones, you sort of wonder what it is that you are missing out on.

Deciding on learning a new language, I was hit by the whole "what to choose" thing again. Lisp has always been something I wanted to look into, but I had a bit of a problem digging into something at I perceived to be (at this point anyways) mostly an academic language. Enter Clojure.

Clojure

Clojure is a Lisp dialect for the JVM. The java integration seems (if anything) to be better then most JVM languages, which means you get all java libraries pretty much out of the box. It takes an opinionated stance on concurrency, and all data structures are both fast and immutable out of the box. In fact, to introduce any sort of mutability, you have to jump through some hoops. While the performance isn't at the level of java, it comes very close for most things, generally doing better then languages like JRuby and JPython.

As a web guy, all this means that you get existing java servers and infrastructure out of the box. There is also a minimalist web framework called Compojure which, while in its early stages, already is pretty awesome.

First Impressions

Probably something along the lines of "wtf.". I've got a decent amount of languages under my belt at this point, and usually learning a new one involves a whole bunch of easy to understand syntax, and then a couple of topics that require some work to wrap my head around. Clojure hasn't been like that. Pretty much from the first page of Pragmatic Clojure, it has been along the lines of "read two pages, realize I didn't fully grasp what was on the previous page, jump back and read it again".

I am nowhere near the point where I could write something more significant then a hello, world style app. That being said, I have been enjoying working at it, and have been very impressed by what I have grokked so far. More on this in weeks to come.

I have a theory that "aptitude" has more to do with loving something enough to be willing to pound your head against the wall on it until you gain some level of competency. There are some people who are naturally gifted, but those are the exceptions, not the rule. For most of us, the difference between the apprentice and the master is about 10, 000 hours of hard work. This is a post that follows that train of thought.

Ruby is known for its powerful and elegant reflection/introspection APIs. While I didn't really learn much from reading this blog entry, I find he did a very good job of making his point: if anything, javascript is even MORE suited to metaprogramming then ruby.

Worth the read for this quote alone from Doug Crockford

JavaScript has more in common with functional languages like Lisp or Scheme than with C or Java.

So this is just the coolest thing evar.

One of the prime motivations for Microsoft doing its IronRuby and IronPython work is as embedable languages in existing CLR applications. When I read that I was sort of underwhelmed, expecting some really hairy communication mechanisms like com interop. Boy, I was wrong.

The general idea is each dynamic language implements a ScriptEngine, which is used by the DLR hosting framework. Because it is interface based, you can work with any DLR language exactly the same way. This means that by going this route, you get support for ruby, python, scheme, etc. Which is hela-cool.

From the hosting application point of view, what you need is a ScriptRuntime (which takes a ScriptEngine). The runtime will then be able to give you a ScriptScope object, which is basically the bride that you use to communicate with the hosted script. You can register assemblies or objects with the scope, and those values become accessable from the hosted script. By the same tolken, the hosted script can register values, that can then be read from the hosting application.

Something like this

var csharp_var = "I am set from C# land";
var ruby = "csharp_land = :ruby_ftw.to_s"; // my odd ruby example

var runtime = new ScriptRuntime("rb");
var scope = runtime.CreateScope();

scope.SetVariable("csharp_land", csharp_var) 
// expose the c# variable to hosted ruby

Console.WriteLine("Before script execution: " + csharp_var); 
// Before script execution: I am set from C# land
runtime.Execute(ruby, scope);
Console.WriteLine("After script execution: " + csharp_var); 
// After script execution: ruby_ftw

Freakin awesome.

Want to expose a library? runtime.LoadAssembly(<Assembly>). Want to get a variable from the script? scope.GetVariable(<name>). You can even get methods defined in the script in to C#, and they will be defined as Actions or Funcs, allowing you to do callbacks.

The thing that I like about this isn't so much that its possible, it is that you can implement it in about 3 lines of extremely straight forward C#. Even things like UI scripting for automated tests becomes trivial, you just expose the base object on each form and you are pretty much done; full access to the code at runtime.

I really didn't expect to be excited about this, but it really may be the highlight session for me from PDC09. If you are interested in this, here is the vid

Javascript gets a lot of hate from a lot of people. Most of that comes from the name (java script) and the syntactic similarity to that language. Because of that, people say to themselves "Because I know java, I don't need to actually learn anything, I can just start coding" and either proceed to write extremely poor javascript, or just start hitting brick walls.

Personally, I have been doing rich interfaces since before "Ajax" was a thing, and have a great deal of experience working with the language. Compared to the way it used to be, we are entering a golden age for the language, where the platform innovation just seems to be growing exponentially every year.

That being said, there are still language warts, not the least of which is how java-esque everything is. Some things can be solved by libraries which fundamentally change the way you write the language in the first place (like the john resig school of unobtrusive javascript via jquery) Others are too baked in to the syntax to really be able to address.

Enter CoffeeScript.

# Assignment:
number: 42
opposite_day: true

# Conditions:
number: -42 if opposite_day

# Functions:
square: x => x * x.

# Arrays:
list: [1, 2, 3, 4, 5]

# Objects:
math: {
  root:   Math.sqrt
  square: square
  cube:   x => x * square(x).
}

# Array comprehensions:
cubed_list: math.cube(num) for num in list.

becomes

var __a, __b, __c, __d, cubed_list, list, math, num, number, opposite_day, square;
// Assignment:
number = 42;
opposite_day = true;
// Conditions:
if (opposite_day) {
  number = -42;
}
// Functions:
square = function(x) {
  return x * x;
};
// Arrays:
list = [1, 2, 3, 4, 5];
// Objects:
math = {
  root: Math.sqrt,
  square: square,
  cube: function(x) {
    return x * square(x);
  }
};
// Array comprehensions:
__a = list;
__d = [];
for (__b=0, __c=__a.length; __b<__c; __b++) {
  num = __a[__b];
  __d[__b] = math.cube(num);
}
cubed_list = __d;

First thing I thought was "Oh look, Python.".

Looking closer, and it isn't just painting everything python. It is targeting either verbose or inconsistent syntax features, and replacing them with something better (often, but not always, lifted from python). It shows a good understanding of javascript (and where the real pain points are).

If I were to use a language like this, this would probably be the one. If I were to make a bet on a language like this that will gain traction, this would not be where I put my money (if anything, it would probably be obj-j).

Really cool writeup on the close tab behavior in chrome. The difference between a good UI and a great UI is all about attention to detail, subtlety, and not settling for "good enough" or the status quo.

Link

I have worked professionally for several years in both Java and C#. Enough time to get to know the quirks of each community, and get an understanding of the languages. One thing that always irked me in Java that I found refreshingly not there in C#, is this hatred of anything new. There has been discussion about introducing closures for years in the java world, but people just don't want to see it. They say the whole anonymous class thing they do now means they don't need a feature like that, while completely ignoring all the things that closures can be used for which anonymous classes won't work on.

By contrast, MS goes on stage at a PDC and introduces something like LINQ, which is a pretty invasive change into the language, and everyone cheers. To go back to the closures example, they already had function pointers, but the introduction of lambdas was met with great joy. In fact, it is hard to think of a single language feature or library that people didn't fall head over heels for (even when it was already implemented better elsewhere, or just plain sucked), until Anders started messing with types.

Don't you dare touch my types

It started with .net 3.5, with the introduction of the var keyword. For those who don't know C#, var is some extremely basic type inference, a concept that has been around at least for 30 years now. The idea is that in cases where the compiler can figure out the type at compile time, don't force developers to pedantically write it out. Static languages tend to be very verbose, so this kind of thing is pure gold. It will shorten something like this

into

Granted, this is a contrived example. But in what world is the first more clear then the last? You would think that it is something that would only upset people who enjoy pointless typing. But that didn't happen, the same people who loved LINQ, freaked the hell out at var. As Phil Haack put it, it was something along these lines

"My friend used the var keyword in his program and it formatted his hard drive, irradiate his crotch, and caused the recent economic crash. True story."

When I saw var I was like, "Man, why couldn't they have done inference for method signatures or properties?", everyone else was freaking the hell out.

Bad vs Unfamiliar

I think this is the real problem. Even in a community that is willing to accept change, something like the type system is a fundamental part of how you read and write code. It's not some new library, it changes the way you think about things. Because of that, people look at things like var (and now dynamic), and see something they can't read the same way. Since they have a high proficiency in their language of choice (and little to none in others), they fall into the blub programmer trap

"As long as our hypothetical Blub programmer is looking down the power continuum, he knows he's looking down. Languages less powerful than Blub are obviously less powerful, because they're missing some feature he's used to. But when our hypothetical Blub programmer looks in the other direction, up the power continuum, he doesn't realize he's looking up. What he sees are merely weird languages. He probably considers them about equivalent in power to Blub, but with all this other hairy stuff thrown in as well. Blub is good enough for him, because he thinks in Blub."

New Languages

I have no idea who said it, but there is sort of a meme going around that programmers who want to improve their craft should try to learn a new language a year. Each time you do this, it will force you to think about code in a new way. Each time you do that, it becomes easier to evaluate language features and libraries based on their merit, rather then on their familiarity.

Back to var

Back to the var keyword, it is very easy to find examples that are obvious improvements to code readability. The other side of the argument often brings up

var thing = DumbName.GetSomething();

vs

Person thing = DumbName.GetSomething();

In the second case, it is obvious what is happening, and the first case removes that clarity. What I say to that is that if you cannot tell what is going on from the call or the variable name, then you are using the type name as a crutch, and you need to use better names for things. It is possible to come up with an example where var will directly lead to a reduction in clarity, but those cases should be considered failures in inspiration or architecture, not the norm.

They say that you don't really know a language fully until you are able to list at least five things that you really hate about it. Overall, I would rather work with C# then other C-esque languages that are around, but that being said, there are things about it that irritate the crap out of me.

1) ??, the null coelescing operator

Ok, so && means and, and || means or in an expression. For null coalescing, you can use the ?? operator. It will evaluate the left side, if it is not null, it will use it, else it will use whatever is at the other side of the ??.

string a = "foo";
string b = "bar";

var c = a ?? b;
Console.WriteLine(c); // prints foo

a = null

var d = a ?? b;
Console.WriteLine(d); // prints bar

Both straight forward, and a great language feature. Here is my question, why not use the or operator for what is essentially an or operation? In ruby, the previous block would be done like this:

a ='foo'
b = 'bar'

c = a || b;
puts c # prints foo

a = nil

d = a || b
puts d # prints bar

To me, that is a hell of a lot more readable. You can also do things like

function_one && function_two # only calls function two if function two returns a "truthy" value
function_one || function_two # only calls function two if function one returns a "falsy" value

While abuse of that can lead to unreadable code, but if you are working at a fairly high level in your code base, this can make things both more terse and more readable.

It may seem odd to have such a strong feeling over semantics, but I find it irritating to see a fantastic idea that could be so elegantly miss the mark for such a simple reason.

The idea of "truthy"/"falsey" values leads us to point two:

2) Why is null not an object?

Ok, so this mostly stems from typing string.IsNullOrEmpty(s); about a billion times a day, which is a slight improvement over the older (and more frustrating)

if (string.IsNullOrEmpty(stringVal)) {}

becomes

if string_val.empty? {}

better yet, in python, all objects have a method that defines boolean coercion, where both nil and "" are considered false. so the previous example is

if string_val:

That is what I want to see

irb(main):001:0> NilClass.methods
=> ["inspect", "instance_method", "private_class_method", "const_missing", "clone", "public_methods", "public_instance_methods", "display", "instance_variable_defined?", "method_defined?", "superclass", "equal?", "freeze", "included_modules", "const_get", "methods", "respond_to?", "module_eval", "class_variables", "autoload?", "dup", "protected_instance_methods", "instance_variables", "public_method_defined?", "__id__", "method", "eql?", "const_set", "id", "singleton_methods", "send", "class_eval", "taint", "frozen?", "instance_variable_get", "include?", "private_instance_methods", "__send__", "instance_of?", "private_method_defined?", "to_a", "name", "type", "<", "protected_methods", "instance_eval", "object_id", "<=>", "==", ">", "===", "instance_variable_set", "kind_of?", "extend", "protected_method_defined?", "const_defined?", ">=", "ancestors", "to_s", "<=", "public_class_method", "allocate", "hash", "class", "instance_methods", "tainted?", "=~", "private_methods", "class_variable_defined?", "autoload", "nil?", "untaint", "constants", "is_a?"]

Now that is a useful nil

3) Consistency

Generics and type inference are both wonderful things, but their implementations are quite inconsistent. Type inference systems have been around for ages now, why can't C# infer method signature types? Or generic types?

Better yet, properties are just sugar, the compiler will turn

string Prop { get; set; }

into

public string get_Prop(){}
public void set_Prop(string value) {}

So, considering that they are just methods, why cant you do

Prop<T> { get; set; }

while you can do

public T GetProp<T>() {}

Same deal with ref and out, properties are treated as something totally different, while behind the scenes it is just another set of methods.

This isn't the sort of thing you

4) Oddly Named Methods

There are certain concepts when it comes to functional style programming that are pretty much universally understood, like map, reduce, and filter. If you talk to a programmer about a map function, it doesn't matter if he uses python or if he uses java, he will know what you are talking about. Not so for the .net guy

Map becomes Enumerable.Select, reduce/fold/accumulate becomes Enumerable.Aggregate, and filter becomes Enumerable.Where. Why? Who the hell knows.

5) Poor Engineering in the Standard Library

Three basic ideas that are almost universally considered to be true are that you should favor composition over inheritance, the Liskov Substitution Principal, which states that objects should be open for extension, but closed for modification, and the Interface Substitution Principal, which means you should use one interface per logical group of functionality, not just one mother interface.

The BCL favors inheritance over composition, uses sealed like some sort of mantra, rarely (if ever) uses the virtual keyword, and seems to love the idea of interfaces with about a billion methods (ever try to implement a membership provider interface?)

Generally when you have an "Everything and the kitchen sink" type libraries from a single vender, you end up with some sort of predjudice or blind spots that go through things. In java, the problem is over engineering. .Net is much more practical and "down to earth" (for lack of a better term), but there are some places that makes testability and flexibility a huge pain to implement.

Conclusion

Again, this isn't to bash C# or .Net. There are a great deal more then five things that I do like about it. The fact that it is an evolving language, especially compared to java which hasn't really moved at all in the last few years. The pragmatic approach is definately appreciated when it comes to getting things done quickly. As someone who has been using it professionally for a few years now, these are just personal gripes.

Great post on the value of log files, and how using a debugger during development often means that logging quality isn't really thought about until it is needed to diagnose a problem in production, at which point it is too late to add (easily anyways)

Link

Just ran across this post, and Scoble says more or less the same thing as I did about Chrome OS, which is pretty much the opposite of what everyone else is saying.

Link

This post is a follow up to Setting Up a Rails Development Environment On Windows

Probably the best thing about Windows is the sheer amount of software that is available. Given any obscure task, you will have about 300 packages to choose from. The downside to this is that about 295 will be total garbage. There are tools out there to make web development on windows not painful, you just need to know where to look and what to spend money on.

Agent Ransack

Built in windows search is both clunky and slow. We can just use grep, but sometimes having a graphical shell as well is nice to use. This is where Agent Ransack steps in. With decent shell integration (right click on a folder and click "Search with agent ransack") and the sort of features you would expect from a searching app (which includes insanely fast searching), it is a great graphical alternative to grep. I find if I am on the command line already, I will just grep for it. If I am not, or am really not sure what I am looking for, I will agent ransack.

Color Cop

A universal eyedropper is pretty vital for anyone involved in web development. It is something that comes out of the box on OSX, but thankfully, Color Cop is a free option available on windows that gets the job done.

Console2

Not only does windows have pretty much the worst set of commandline apps out there, the terminal emulator it ships with is hands down the worst anyone could possibly come up with. Console2 is better in about a million ways, but shift-drag to select text, and middle click to paste is by itself enough to justify the download.

Process Explorer

From the sysinternals guy, Process Explorer basically lets you walk through process families, and lets you see what files/dlls/registry keys each process has a lock on. On a system without fuser, it is pretty damn vital functionality.

Regex Buddy(39.95$)

This is one tool where I have yet to see the equivilent on any system. While there are plenty of regex tools out there, this one is a cut above, and will pay for itself the first time you need to work with more then a trivial regular expression. Highly recommended

Beyond Compare(30.00$)

This one is available on both windows and linux, but again, is hands down the best merge tool I have ever used. Merging is one of those things that is a real pain, and I have no trouble shelling out 30$ to make my life easier.

WinMerge

If you are too cheap to shell out 30$ for merging, this is the next alternative (what we use at the shop I work at). It will leave you with plenty to be irritated about, but it will get the job done.

Filezilla

FTPing is a fact of life, and you need something decent to get the job done. FileZilla doesn't have some of the fancy features of something like CuteFtp, or the hacking tool appeal of FlashFXP, but honestly, unless you are engaged in illegal activities involving either the transfer of massive files, or the tagging of public ftp sites, I think FileZilla will be enough for the job.

gVim

Here is the funny thing, I very rarely use vim to actually write code in, but I consider it an absolutely essential tool for any developer. There is no better editor for jumping around in text, or applying transformations to code then gvim, and the fact that vim is installed on pretty much every unix machine out there, being comfortable with it is a really great career skill. For me personally, I find the modality of it to be a pain for really long coding sessions, but for some it is really the only way to go. It seems hard to grok at first, but I got fairly proficient in about a week of use.

This is really the topic of another post, but if you decide to go down this road, feel free to grab my windows-ified vim configuration package at http://github.com/mbriggs/vimfiles

E-TextEditor(34.95$)

When I am working on something that doesn't require a massive IDE just to be managable, I like going with a good, lightweight editor. IMO, the best of these is TextMate, but unfortunately, it is OSX only. e is as close as you will get on any other platform, and at 35$ it is a steal.

TextMate has some of the best snippit support out there, and e is compatible with the textmate bundles.

RubyMine(99$)

So, like I said before, when I can get away with it, I would rather just use an editor and a few commandline tools, rather then firing up massive IDEs. There are a few places where IDEs will have a dramatically positive impact on your productivity; for navigating unfamiliar codebases, doing refactoring, and there really is no good replacement for a good visual debugger. If I am doing any of those things, RubyMine is the tool I will reach for.

There are other, solid choices when it comes to ruby IDEs out there, like netbeans or radrails. I have been using JetBrains products pretty much as long as I have been a professional developer though, (IDEa for java, ReSharper for C#, and now RubyMine for ruby), and they consistantly do the best job compared to the competition.

The first thing you learn when you start paying attention to industry news is that the tech media are a bunch of gibbering morons. That is why when Chrome OS was announced, you got headlines like:

• Google Drops A Nuclear Bomb On Microsoft. And It's Made of Chrome.
• With Chrome OS, Google Intends to Destroy the Desktop and Microsoft
• Google rides Chrome OS onto Microsoft turf

The sad truth is that Windows is only in competition with Chrome in areas where windows exists because nobody has bothered to do anything better for a specific niche yet. This is google setting up shop in a niche, not looking to topple MS.

Chrome is basically an extremely light weight OS, that is only really there to house a browser. The amount of people who only use their computer for facebook, email, chat, and web browsing is pretty large, the question isn't why is google developing a portable browser appliance, the question is why haven't people done this before.

Just think, with no local storage, you can throw out the hard drive and replace it with cheap flash memory. With a minimal OS you need as much ram and cpu power as a few instances of flash will require. The requirements are less then the lowest end netbook, if they make good enough deals, they could ship 12" machines between 50-100$ that basically connect to a network and launch a browser. The price is right, the size is right, the weight would be next to nothing, and nobody can match the 3-4 seconds between power on to internet browsing.

That sounds like a really attractive device, I know if it is less then 100$ I'll definately be picking one up.

Really well put together debunking of the whole 2012 thing. Next time someone is going on about it, this is a great place to send them.

Link

It helps to read it in the voice of Buzz Killington

Link

Awhile back, DHH unleashed one of his many shitstorms with this comment

I would have a hard time imagining hiring a programmer who was still on Windows for 37signals. If you don't care enough about your tools to get the best, your burden of proof just got a lot heavier.

Now, he had reasons for this. Apart from that OSX is a great platform for web development pretty much out of the box, and that it both has the unix userland and the gcc toolchain, there are other reasons as well. Both the ruby and rails core teams are all on macs. Most rails developers are on macs. Ruby on windows is even slow compared to ruby on other platforms. Because of all of this, many rails plugins and ruby libraries are rarely (if ever) tested on windows.

Now, for some of us it isn't about caring, more about the price tag attached to apple products compared to the competition, and the whole value for money thing. I am getting pretty serious about rails, and will probably be picking up an iMac fairly soon, but it has taken me awhile to get to this point. For people who are not in the position of working with rails professionally, there is a high barrier to entry unless you are already a mac user.

Hopefully, this will help people get to where they can easily and effectively develop rails stuff on windows.

Environment

Now, a lot of people will suggest Instant Rails for getting going on windows. Personally, I would rather choose my own tools (I don't like doing dev stuff on MySQL), and while it is quick to get off the ground, you are pretty much stuck with that stack. Also, upgrading or changing individual bits are pretty tough.

Ruby

Most people will type "Ruby" into google, head over to ruby-lang.org, and click download.

DO NOT DO THIS

The "One-click Installer" is built using an obsolete visual c++ compiler, and will leave you unable to build native gems. The far superior alternative is to head over to http://rubyinstaller.org/ and hit download. Scroll down to the Ruby Installer builds, and find the latest 1.8.x executable (currently, this is rubyinstaller-1.8.6-p383-rc1.exe) Download that and install.

This will give you ruby, but the next problem we have is there is no gcc toolchain. To fix that, go back to http://rubyinstaller.org/, and click "Addons". Download "Dev Kit", and then extract it into your ruby directory. This is an archive that has gcc and friends, and a few stubs so that gems can build for you without any hassle.

Finally, make sure ruby is in your path. To do this, right click "My Computer", and (if you are on Vista/7) click on "Advanced System Settings". This will pop up another tabbed dialog, click on "Advanced", and then way at the bottom of the pane, click on "Environment Variables". In the bottom pane (marked System Variables), scroll down until you find Path. Hilight it and click "Edit". This will pop up a third dialog. In the bottom textbox, add "C:\Ruby\bin;" to the beginning of the line. Now click "apply" and "ok" until you have everything closed.

Think this is an insane process to add a value to an environment variable? So do I. What is one line in a console for any unix system is about 50 clicks or so in Windows. But hey, its cheap, and you get what you pay for.

To make sure this worked, open up a console and type ruby -v you should see something like this if everything is cool

D:\Users\matthew.briggs>ruby -v
ruby 1.8.6 (2009-08-04 patchlevel 383) [i386-mingw32]

Git

Currently, the two best source versioning systems out there are Git and [Mercurial][mercurial], everything else is at least a generation behind the times. The ruby world is pretty much universally behind git, and chances are you will need it as soon as you get passed "Hello, World" type stuff.

Head over to the msys-git project on google code, and download the latest version. At one point in the installer, it will ask if you want the msys stuff in your path, and warn you to say "no" unless you know what the consequences are. What they are talking about is that there are some commands (like find) that are named the same both on unix and on windows. If you say yes here, find will be using the unix version in your consoles. Personally, I have no problem with this, and will always say yes (it actually saves me having to install this stuff from other places). The choice is yours. The other thing it asks is if you want to use ssh or PuTTY, choose ssh.

Generate a key

This is used by a great many things, so you may as well do it now. Open up a console (or special git console if you chose to keep it out of your path), and type ssh-keygen. It will ask a bunch of questions, feel free to choose the default answer to them all.

This will generate an rsa key in your home directory, under .ssh/id_rsa and .ssh/id_rsa.pub. You probably want to keep a copy of these around, since they will be your identification when using any of a number of services. Also, keep in mind that your public key is used to authenticate you, so it is fine to give that to sites and services. Your private key is secret, anyone who has it can masquerade as you.

Getting some gems

In ruby, libraries are almost always packaged as "gems", and there is a package manager for these gems called "rubygems". First things first, lets grab rails. Open up a console, and type gem install rails. Rails has a boatload of dependencies, install all of them when prompted. Once everything is done, try typing rails -v at the console. You should see something like this

D:\Users\matthew.briggs>rails -v
Rails 2.3.4

Now that we have rails, lets get some other goodies. Type gem install mongrel ruby-debug sqlite3-ruby This will install the ruby debugger, mongrel (a much better pure ruby server for developing on, default is webrick which kind of sucks), and sqlite ruby bindings. There is one more step, sqlite requires a binary component you will have to grab seperately. Head over to the sqlite website, click download, scroll down to "Precompiled Binaries For Windows", and download the standalone dll. Extract the archive into your ruby/bin folder, and you should be done.

sqlite is an in memory database that is used by default in rails. what is great about it is that you don't even have to think about installing, configuring, or adminstrating a database server until you are ready to deploy to a production environment. If you think the whole dll thing is a pain, try a MySql install. I'm sure you will be back :)

Test to make sure it all works together

At this point, lets make sure everything is working. Try entering the following commands, you should see the same sort of following output

D:\Users\matthew.briggs>rails installtest
      create
      create  app/controllers
      create  app/helpers
      create  app/models
      create  app/views/layouts
      create  config/environments
      create  config/initializers
      create  config/locales
      create  db
      create  doc
      create  lib
      create  lib/tasks
      create  log
      create  public/images
      create  public/javascripts
      create  public/stylesheets
      create  script/performance
      create  test/fixtures
      create  test/functional
      create  test/integration
      create  test/performance
      create  test/unit
      create  vendor
      create  vendor/plugins
      create  tmp/sessions
      create  tmp/sockets
      create  tmp/cache
      create  tmp/pids
      create  Rakefile
      create  README
      create  app/controllers/application_controller.rb
      create  app/helpers/application_helper.rb
      create  config/database.yml
      create  config/routes.rb
      create  config/locales/en.yml
      create  db/seeds.rb
      create  config/initializers/backtrace_silencers.rb
      create  config/initializers/inflections.rb
      create  config/initializers/mime_types.rb
      create  config/initializers/new_rails_defaults.rb
      create  config/initializers/session_store.rb
      create  config/environment.rb
      create  config/boot.rb
      create  config/environments/production.rb
      create  config/environments/development.rb
      create  config/environments/test.rb
      create  script/about
      create  script/console
      create  script/dbconsole
      create  script/destroy
      create  script/generate
      create  script/runner
      create  script/server
      create  script/plugin
      create  script/performance/benchmarker
      create  script/performance/profiler
      create  test/test_helper.rb
      create  test/performance/browsing_test.rb
      create  public/404.html
      create  public/422.html
      create  public/500.html
      create  public/index.html
      create  public/favicon.ico
      create  public/robots.txt
      create  public/images/rails.png
      create  public/javascripts/prototype.js
      create  public/javascripts/effects.js
      create  public/javascripts/dragdrop.js
      create  public/javascripts/controls.js
      create  public/javascripts/application.js
      create  doc/README_FOR_APP
      create  log/server.log
      create  log/production.log
      create  log/development.log
      create  log/test.log

D:\Users\matthew.briggs>cd installtest

D:\Users\matthew.briggs\installtest>rake db:create
(in D:/Users/matthew.briggs/installtest)

D:\Users\matthew.briggs\installtest>rake test
(in D:/Users/matthew.briggs/installtest)
D:/Users/matthew.briggs/installtest/db/schema.rb doesnt exist yet. Run "rake db:migrate" to create it then try again. If you do not intend to use a d
atabase, you should instead alter D:/Users/matthew.briggs/installtest/config/environment.rb to prevent active_record from loading: config.frameworks -
= [ :active_record ]

D:\Users\matthew.briggs\installtest>rake db:migrate
(in D:/Users/matthew.briggs/installtest)

D:\Users\matthew.briggs\installtest>ruby script/server
=> Booting Mongrel
=> Rails 2.3.4 application starting on http://0.0.0.0:3000
=> Call with -d to detach
=> Ctrl-C to shutdown server

At this point, open a browser, and go to http://localhost:3000. You should see the "Rails is installed

What Now?

Here is where things start to suck. We need some decent tools, and unfortunately they are pretty sparse in windows. This is a topic for another post, at which point I will go into some suggestions on editors, IDEs, debugging, and utilities for working on rails in windows.

Coding Horror has stood on the edge of getting removed from my rss reader for ages now. It is posts like this that keep it there.

9 Ways Marketing Weasels Will Try to Manipulate You

Another gem from Hacker News, this one is about a guy who lives (by choice) in a 96 sq foot house

Link

Ran across this on Hacker News. 2007 post, highly recommended

Nerd Handbook