weekends are for leisure

It Starts with Florida

Sat, 21 Apr 2012 10:08:00 -0700

Just read the Nov/Dev 2011 Audobon magazine article, Life Support, about the improving state of Everglades since the author’s previous visit 10 years ago. I won’t go into the details of the article. Nor will I pretend to have a solution for that region. However, the article conjured up some environmentally-related memories from growing up in Florida, so here goes:

As a child I was frequently puzzled by the fact that nobody knew exactly what to do with their old engine oil. Most people I knew dumped it in some far-away back corner of their property. They’d even joke about it probably not being the best thing to do, but they’d then comment on the low quantity and low frequency. And of course, I’ve done the same on many occasions. After all, I was in charge of mowing the lawn, which necessitate oil changes and removal of old gasoline from the previous season. I’d dump it reluctantly, because there didn’t seem to exist any alternative.

In 2001, when I bought my first vehicle I began to change my own oil. While purchasing oil and a filter I asked an employee at Discount Auto Parts about used oil. He told me there was a large blue container in the back that I could dump it in. Finally!

Truth be told, I have no clue what engine oil really does to the soil, or the organisms living in the soil, or the water table below. But that doesn’t matter. The possibility never sat well with me. I was just happy I didn’t have to play the cognitive dissonance game with myself. No more wanting to care about the environment while potentially damaging it and then deciding I’m not that big of a hippie after all. That sort of behavior (mental gymnastics) doesn’t help anybody. Moving on …

A few years after high school I saw a classmate who’d been living in a larger city after college. She had a job with some sort of environmental consultant. The news of that made me happy, but the way she described her job ruined my mood. I’m paraphrasing, but I recall her describing it as “making sure people get to use their land in the way they want”. I’m not sure whether my face showed my disappointment, but I felt horrible nonetheless.

There’s so much danger in letting everyone have free-reign over their land. A piece of property comes with plants and animals that depend on it, in numbers hard to comprehend. The world is complex, and it’s at our mercy. Not enough of us are considerate.

However, property-rights would be a lot easier to debate about if it weren’t for these problems:

It’s hard to educate or inform others without being abrasive
It’s hard to suppress the desire to stand your ground when another person suggests you might be in the wrong
It’s hard to make a person care
As humans we often think we’re the most important things on the earth, even though we’re not endangered in any way (but from ourselves)

We’d make much more progress if these four items weren’t such huge barriers.

Tag stripping not sufficient to prevent JavaScript injections

Wed, 28 Mar 2012 13:58:00 -0700

In the PHP world, solely relying upon PHP’s strip_tags() function to protect your web application from JavaScript injections is a bad idea. If you do, you may be vulnerable in even the most recent browsers (I tested in Chrome 17.0.963.83, Firefox 9.0.1 and Internet Explorer 9). There may be parallels in other languages too, so beware.

You’ll be vulnerable if the following are true:

You’ve got a webapp that accepts user input
You use strip_tags() or similar to sanitize fields
You don’t explicitly remove less-than or greater-than characters from those fields (PHP’s strip_tags won’t remove a partial “<script” tag)
Values from two or more of these fields are printed close to each other in the output HTML, with little or no markup between them

The fourth item is tricky … The markup between the field values must not contain any quotes (the quotes would prematurely close the script tag injection attempt). In other words, it’s possible for an opening SCRIPT tag to be constructed using values from two subsequent user-input fields.

Granted, the vulnerability only arises if markup is formatted in a very specific way, but it’s worth taking another look at your code. See this gist with example HTML for what it looks like to your browser.

I submitted a Chromium bug report, but it’s something they’re not interested in fixing.

Guess we’re on our own.

How to GitHub: Fork, Branch, Track, Squash and Pull Request

Tue, 27 Mar 2012 21:36:00 -0700

How to GitHub: Fork, Branch, Track, Squash and Pull Request:

Oh thank god! Branching I understood, but was clueless when it came to pushing up a specific branch.

Rebasing too … reminds me of how we badly need a separate dev environment at work. Ugh.

In all, a wonderful tutorial that helps you play along with others while programming.

Why French Parents Are Superior by Pamela Druckerman - WSJ.com

Sun, 19 Feb 2012 12:08:00 -0800

Why French Parents Are Superior by Pamela Druckerman - WSJ.com:

No, I’m far from having kids, but this was insightful nonetheless. Some noteworthy paragraphs:

One of the keys to this education is the simple act of learning how to wait. It is why the French babies I meet mostly sleep through the night from two or three months old. Their parents don’t pick them up the second they start crying, allowing the babies to learn how to fall back asleep. It is also why French toddlers will sit happily at a restaurant. Rather than snacking all day like American children, they mostly have to wait until mealtime to eat. (French kids consistently have three meals a day and one snack around 4 p.m.)

And (Pauline is the child):

When Pauline tried to interrupt our conversation, Delphine said, “Just wait two minutes, my little one. I’m in the middle of talking.” It was both very polite and very firm. I was struck both by how sweetly Delphine said it and by how certain she seemed that Pauline would obey her. Delphine was also teaching her kids a related skill: learning to play by themselves. “The most important thing is that he learns to be happy by himself,” she said of her son, Aubane.

Amen to learning to be happy by oneself. I’m paraphrasing, but I once heard this and really like it: Being alone is different than being lonely.

American parents want their kids to be patient, of course. We encourage our kids to share, to wait their turn, to set the table and to practice the piano. But patience isn’t a skill that we hone quite as assiduously as French parents do. We tend to view whether kids are good at waiting as a matter of temperament. In our view, parents either luck out and get a child who waits well or they don’t.

It closes with an illustration that Americans often don’t say “no” with enough conviction. When my dad reprimanded us, he meant it and we knew it. It’s a wonderful thing in retrospect.

Not certain

Mon, 16 Jan 2012 09:31:00 -0800

Watched a 2005 Oregon PBS special about forest management last night. Link here. Saw some old guys with lots of land and trees managing it with intelligence. They don’t clear-cut. They have a clue about genetics so they save the best trees and sell the others. Made me think: Damn that looks like fun, rewarding work!

Especially the bits involving data collection. One guy kept detailed logs and found that his trees put on mass much faster later in life, but most loggers harvest before that point. I’d love to pay attention and keep those kinds of numbers. The data loving techie in me is thinking: GPS for each tree, monitoring CO2 and other levels around my property. Of course, I wouldn’t want the financial pressure of that being my only source of income. Luckily I’ve been a telecommuting programmer for years … been fortunate.

The downside is that I like living in the city. Love the density, the energy, the white noise, the grocery store 1.5 blocks away, the access to varied restaurants and lattes, the ability to walk for hours and see new parts of town. And of course, I don’t enjoy driving.

Something to think about.

A dispatch from the Moose Ear Diner

Mon, 12 Dec 2011 16:00:01 -0800

Completed Puzzle Agent recently. It was such a fun game and luckily the sequel went on sale a few days after I finished it. The puzzles were a balanced mix of 10-second teasers, those where your only hope is to jump in and work through possible solutions, and those where you really need to pay attention.

Aside from the puzzles, the other aspects of the game are no slouch either. The story draws you in and has quite a few surprises. The art work is simple, high quality, and infused with a playful sense of humor. Can’t wait to start the sequel.

The Thin Man

Mon, 28 Nov 2011 08:40:40 -0800

The Thin Man is a great movie. It’s filled with lovable characters, great pacing and a great plot. And of course I must mention the hilarious, witty protagonists. Luckily it’s only the first in a six-part film series. Looking forward to the rest!

Character encodings in practice

Thu, 03 Nov 2011 09:20:00 -0700

Building upon Joel’s post on Unicode, here are some real-world tips relating to character encodings.

Use them by name

Always explicitly specify which encoding you want (perhaps UTF-8). Don’t assume the language or library/tool you’re using will make the right decision for you. If you value your time, don’t ignore this recommendation, otherwise you’ll likely spend lots more time patching things up in the future.

A tale to drive this home

Until very recently, MySQL’s default charset was latin1. Our legacy code didn’t specify an encoding in PHP’s connection to MySQL, in our HTML, nor in our HTTP headers. And web browsers default to god knows what (“it depends”).

When the time came to export some table data to XML I ran into issues of invalid UTF-8 characters. I knew there were special characters in some text fields introduced by Microsoft Word copy-pasters, so I figured flipping the switch to UTF-8 would help. NOPE!

It appears that having failed to specify an encoding in the past caused special characters (fancy double-quotes, crosses, long dashes, etc) to be stored in MySQL in a fashion that doesn’t satisfy the UTF-8 format. Shit!

So I had to come up with a batch of find-and-replace regex patterns to turn those characters into proper UTF-8 or their HTML entities.

So please, do the following:

Choose an encoding and stick to it
Save your text files in that encoding
Set the character encoding in your HTML
Send the Content-type header with charset from your webserver
Change the configuration defaults for MySQL or your DBMS
Check and set the default for each of your databases (note I said database not DBMS)
Check and specify the encoding for your tables and text fields
Make sure you specify the encoding when you create or alter tables in the future

Don’t convert blindly

If you failed to do the above at one point in time, you may have content in your database that isn’t valid UTF-8 (assuming you want to convert to that to prevent further issues).

Users that copy and paste from Microsoft Word are likely the source of this problem, but don’t blame them or Word. Blame the programmer responsible!

Your task now is to convert those invalid UTF-8 byte strings into something more usable. You may be able to convert many to their HTML entities, but you probably want to convert alphabetical characters to their valid UTF-8 representation to ensure the text remains easily searchable.

Don’t convert blindlier

If you have to convert your table definitions and data to UTF-8 (from something like MySQL’s latin1), be careful. There’s a great post by the Wordpress crew of what it entails (multi-stage process, to intermediate binary column types first), but it didn’t cover this troublesome gotcha: If MySQL finds characters it can’t convert to UTF-8 it’ll truncate the rest of the field data

MySQL will gladly go through the motions with you as you convert from latin1 to UTF-8. It’ll issue warnings that something went wrong during the conversion. But it will still truncate your data at any character that’s not valid UTF-8. Instantly your article text will go from 10234 bytes to 145. There’s probably a valid technical reason why it doesn’t error out altogether, but all I know is I now have to re-populate tons of data from backups.

node.js FTP server

Wed, 28 Sep 2011 14:41:49 -0700

Got to use node.js for a work project recently. We needed an FTP server with special user authentication that would run custom code after a file was uploaded. There was one node.js FTP server implementation on github, so I forked it and started rounding out the basic functionality. My fork is here.

The first significant change I made was to encapsulate the data connection logic. File lists and file contents are transferred over the data connection (FTP commands and responses over the control connection). I quickly found that some clients are super eager to send you data and will do so once a passive data connection is made, even before the FTP server tells them it’s ok to do so. This was especially problematic for file uploads over passive data connections. Without a workaround for these aggressive clients, the flow looked something like this:

Receive PASV command from client
Start listening on a port and tell client which port to connect to
Receive STOR command from client, stating it’s going to upload a file
Attach data listener to data connection that saves incoming data to file
On data connection end event, make sure file data has been written
Close the file

Due to the asynchronous nature of node.js, data often arrived between steps 3 and 4, before a data event listener had been attached. Some of the file chunks were falling through the cracks and the saved file was incomplete.

Also regarding the above flow, ensuring that all data had been written to disk before we attempted to close file was … well … convoluted. Maybe a solution could be found using fs.createWriteStream, but I’m still happier with what I’ll outline next.

Once I found out that data was falling through the cracks I did some searching and found that setting up a buffering data handler was a common solution to a common problem. Good to know! With a persistent data buffer in place things became much easier, like so:

Receive PASV command from client
Start listening on a port and tell client which port to connect to
Once we get hint of a connection (socket connect event), listen for data events and push each data chunk onto a stack
Receive STOR command from client, stating it’s going to upload a file
On data connection end, open file
Loop over buffered data
Save each buffered chunk before moving to next chunk
Close the file

It’s less than ideal to buffer each uploaded file in memory first, but it works and is simple. Success!

In addition to the above, I’ve encapsulated things further in my forked repo. The FTP server object itself emits some additional events which you can listen for. My goal was to encapsulate the basic FTP functionality and provide a way to take special actions when:

A user connects
A user attempts to log in (listen for these events and handle authentication yourself)
User uploads a file

Hopefully someone with a slightly different use-case will come along and take things the rest of the way.

Nature: Is that Skunk?

Mon, 29 Aug 2011 22:19:00 -0700

Nature: Is that Skunk?:

Caught an episode of Nature last night. Great as always. Spotted skunks …. my, what a coat! You can watch the full episode, just click the title of this post.

Lume Cabinet Lock Hint

Thu, 25 Aug 2011 16:46:00 -0700

If you play the game Lume you may get stuck at the cabinet lock. If so, don’t go to any other sites or you’ll accidentally see the answers like I did! Here’s a hint, instead.

You found the “9#” clue, right? Go back to where you can see that clue on the screen. Everything you need for the lock is right there. That’s all I’ll say.

Photo

Sun, 14 Aug 2011 08:42:55 -0700

I’m curious about i.am FIRST: Science is Rock and Roll. It...

Fri, 12 Aug 2011 14:50:42 -0700

I’m curious about i.am FIRST: Science is Rock and Roll. It will air this Sunday night at 7pm on ABC. I was mostly speechless during the segment of Science Friday that featured Dean Kamen and will.i.am. I have to confess that I actually teared-up out of joy.

This week there was also news of a COSMOS sequel that will be airing on FOX. So glad a chance is being taken and the effort is being made to inspire and educate such a broad audience.

Didn't build a heater

Fri, 05 Aug 2011 22:00:00 -0700

I didn’t expect learning of variations in Core 2 Duo processors and sockets while fixing my mom’s laptop to lead to interest in building a new PC, but that’s what happened. Shopping for parts takes too much time but I powered through, eventually narrowed it down, and made some purchases. Wanted something quiet and efficient (80 Plus Gold power supply, fanless graphics card, Core i5 2400, 8G RAM). Kristen mentioned Bioshock as a game I might like which gave me a performance-related goal.

The new desktop machine means my laptop will mostly sit idle, but since a stand-up desk is my preferred work setup I’m fine with that. In the process I’ll be retiring several ATA drives, the old computer case I’ve had for 10 years, and have now entered the realm of 64-bit operating systems, Intel VT for qemu and quad-core processors. My laptop was dual-core, so it’s not a huge leap, but at least now I can run Folding more effectively.

I’m finding Steam’s “free weekend” promos on newish games to be quite enjoyable. I’ve never been able to play games this new and it’s nice to have something mindless to do for a few hours on weekends, even if it is poking around a first-person shooter. As for games I’ve purchased for more concentrated play: Lume and Machinarium, in addition to the new Sam ‘n Max series and the Monkey Island re-releases.

To close on a more somber note, I hope these money-spending detours are over because I feel I should get back to learning and creating. It’s been a two month hiatus / dry spell. No drumline music, no code outside of work. Sigh.

Notables

Tue, 05 Jul 2011 21:47:16 -0700

I finally finished fixing up my mom’s laptop. Several mis-diagnoses later, and it’s back with the original fan, new processor, new thermal compound, fast maxed-out RAM, new battery, and new install of Windows 7. Whew. One CAN buy laptop processors on Ebay if one pays attention.

The past few months have also taught me that some Amazon sellers will sneak a knock-off product to your doorstep. I attribute this to malice, and not a listing mis-match. Ugh.

In an effort to remove friction from writing music I’m finally going to purchase Sibelius. It’ll integrate nicely with Virtual Drumline, and will hopefully make it easier to get into the habit of writing at least a few notes a day. The goal is to make some progress every day but more specifically I want to benefit from idle-time problem solving that brains tend to do.

Still extremely torn about whether I’m going to teach drumline this year. Forty-hours a week, plus 1-2 practices a week, and having to make up lost work time is NOT an option anymore. Makes me miserable. There is a discussion to be had with my boss, but part of me would rather direct that energy towards writing music or recreation.

Teaching

Thu, 23 Jun 2011 10:00:06 -0700

Recently I became aware that while teaching I sometimes go on and on for far too long. It usually happens when I realize a student isn’t “getting it” after a period of time, after the rest of the group has moved on. I address them personally, repeat the nugget on information, and then I may go into the “why” portion of what I’m talking about, after which I may go into variations that might be helpful to think about, and then I may go back to the original point and re-iterate.

Annoying, right? Yeah. I need to chill. I should instead present one nugget/view/solution/technique and be done with it. It’s best to give the student some breathing room because they’re already a bit stressed if I’m addressing them one-on-one.

If I don’t back off, I run the risk of making the student feel incapable, or upset, or maybe they’ll just turn off. No good.

Bossypants

Tue, 21 Jun 2011 17:46:00 -0700

Couldn’t pass up Tina Fey’s new book, Bossypants. I’ll start by saying that 30 Rock is the best comedy show on network television. And I’d be right. The Office faded fast. Family Guy got old after the 1st season. The Simpsons was probably good 10 years ago (though I was never a huge fan). But I don’t want to write about TV.

So yes, Tina Fey… Heard her interview on Fresh Air and I had to buy her book. If you like Tina Fey, you’ll enjoy it. I’m especially glad she specifically writes about this 30 Rock line … it’s one of the all-time greats:

Never go with a hippie to a second location.

Just amazing. The line is credited to Scott Burritt. I will love him forever, if I can remember his name.

30 Rock is filled with serious fucking words to live by.

BeagleBoard-xM Update

Sun, 19 Jun 2011 10:32:00 -0700

I didn’t know the Angstrom card that shipped with my board would boot into X using DVI-D as the output. Decided to try it yesterday given my serial cable woes (more on that below), and it worked. Ethernet, USB keyboard and mouse, but didn’t test audio. So the board appears to be functioning properly.

Prior to testing the Angstrom card I tried an Android 2.3 image from TI made for the beagleboard, but it failed during the last steps. It booted to a GUI, but the clock obviously didn’t run, and it didn’t respond to input. Guessing it crashed, but I’ll have to investigate further over serial.

Regarding serial cables … I went to FreeGeek to look for some. This was actually my second trip since my first trip I was focused on finding the exact cable and hadn’t considered slicing and re-wiring until recently. The cables I found would have worked if all 9 pins in each cable had wires connected to them, but they didn’t. No doubt the cables are made in this way to save on manufacturing costs. A cable is made for a specific purpose and/or device, which may only use 3 or 4 of the pins. Unfortunately I was unable to find the right combination amongst the cables I picked up, so I was unable to construct a straight-through cable. So after 1.5 weeks of hoping and searching, trying to go the quick, dirty and cheap route, I ordered one. Should arrive Wednesday.

I should note that I didn’t exhaust ALL of my options, and probably should have picked up something like this to do the wiring from. 9 pins, 9 wires, easy access. Now I know.

All of this makes me wonder whether it’s possible to write a serial port device driver that acts as a proxy. For instance: if I only had a serial extension cable but need something else, could I create or use a proxy serial port driver to remap the pins? Would have to investigate further. It sounds like a good idea, but there’s probably some protocol or hardware limitation that makes it impossible.

Wooah there, horsey

Tue, 14 Jun 2011 09:26:31 -0700

Lately, the thing I’ve wanted to yell most at people is “pay attention!” It should probably be prefixed by “slow down!” People don’t read. They don’t listen to what others say. They don’t pay attention to the details. They apparently think they’re effective at multi-tasking at light-speed.

Velocity of Disappointment

Wed, 08 Jun 2011 08:52:00 -0700

I continue to like Merlin Mann’s podcasts. A few weeks ago I stumbled upon Back to Work. Being familiar with You Look Nice Today I figured it had to be good, so I jumped in without a clue what it was about. Turns out to be centered on:

fear
happiness
no-fluff life hacks
creative work

In episode 14, some things that really struck a chord with me were related to job unhappiness. It’s hard to describe my current situation to people. Most people don’t seem to get it. They seem to assume that programming is programming, and that if I enjoy programming, I should be happy programming. No. You wouldn’t question a construction worker that prefers framing over roofing, would you?

Another reason I commonly give is that “the work isn’t challenging”. But this feels like a better explanation:

It doesn’t provide the types of challenges I’m looking for.

Here a great comparison for clarifying one’s use of the word “challenging”: difficult versus stimulating. Both are important, but different.

Writing JavaScript for a user interfaces doesn’t stimulate me. It probably stimulates 99% of the other web programmers, but not me. And it’s plenty challenging. There are many things to think about, to enhance, to design for maximum usability. But no, it doesn’t fulfill me. And that’s related to another thing worth mentioning:

I’m not good at it.

Merlin says the ultimate sweet spot is finding something that is challenging (fulfilling) that you’re ALSO pretty good at. That’s what I’m shooting for.

That’s all for now. I’ll leave you with some mostly unrelated notable quotes from the episode:

“Don’t wanna crush your dream catcher.”

“If you own more than two self-help books you need to stop buying them.”

And regarding chronic self-helpers: “Is it possible that what you’re really scared of is change?”

“You shouldn’t be drinking more if you have to pee.”