Login

FB Connect not working in IE? Fix your xd_receiver.html's HTML namespace extension

<html xmlns="http://www.w3.org/1999/xhtml" 
    xmlns:fb="http://www.facebook.com/2008/fbml">

Internet Explorer 7 is very finicky with its processing of custom tags.

If you're using Facebooker, it actually currently does NOT include this in the html tag of the xd_receiver.html -- so if you try to log into fbconnect using IE7 on an app with the default generated file, it will just fail with a white screen in the login window.

TRICKY. But Forums and Google Search to the rescue once again.

I'm trying to blog these little stumbling blocks back because it'll help Google reinforce the right links just a bit more. Programmer solidarity =)

Running IE6, IE7 and IE8 on your Mac

I use a Mac, which means testing my work in IE6, IE7 and IE8 is a pain. I have Parallels installed but I don’t want to buy extra copies of Windows just to test in IE. Plus, Parallels doesn’t compress the virtual hard drive so each OS takes about 10 - 20GB of space.

The good news is that Microsoft provides free VirtualPC disk images for each of their browsers.

The bad news is that they wont run on Mac and VirtualPC wont run inside Parallels or VMWare Fusion — but I’ve found a solution! We can convert the disk images to work for VMWare Fusion or VirtualBox.

I'm giving this a shot... *crosses fingers* -- will update when it's good to go.

A comprehensive primer about CSRF, Session attacks, Redirection, XSS attacks and MySQL security for Rails

Totally awesome. Must-read for any production Rails dev. Heiko Webers is totally providing a huge service by compiling a comprehensive list of items to check for.

Rails/MySQL surprise of the day: WHERE clauses on VARCHARs are not case sensitive by default

Ran into a totally from-left field bug today, and was surprised to find that WHERE clauses against VARCHAR fields are totally case insensitive. So if you have two rows in table FOO that have values "Bar" and "bar", and you run SELECT * FROM Foo WHERE FIELD = 'Bar' -- you will actually get BOTH 'Bar' and 'bar' rows returned.

Now there are ways in which you can set a particular column to always be treated in a case sensitive manner.

But the simple/braindead fix to make your query case sensitive is to use this instead: SELECT * FROM FOO WHERE FIELD LIKE BINARY 'Bar'  -- running that will cause case sensitive behavior to occur and only one row to be returned.

And knowing is half the battle.

Haskell Hackers vs Blub Java Engineers

If you post an advert for a Haskell developer you will get 20 applicants. All of those people will be the kind of developer who learns new programming languages to improve their own abilities and stretch themselves, because nobody yet learns Haskell just to get a job.

If you post an advert for a Java developer you will get 200 applicants. Most of them will be the kind of developer who learned Java because there are lots of Java jobs out there, and as long as they know enough to hold down a job then they see no reason to learn anything.

If you're a 100% Java coder, you'll always have a job, and there are legitimately interesting things that are happening in the Java world... but its pretty far from a majority in any sense. The problem with Java is that there are too many jobs that only need passable engineers. There are too many Java engineers who are plug-and-chug.

It's all about the hobbyist languages. That's where the magic happens. If you're a Java engineer, you should pick up Ruby on Rails at least -- it'll be a breath of fresh air.

Javascript super killer tip: Always use innerHTML if you have no JS lib and it has to work in IE.

Recently while writing some features for Posterous, I ran into a super simple but insanely annoying bug where IE fails to properly pick up id and name fields when creating new DOM elements in JavaScript using document.createElement().

Internet Explorer completely fails to add created DOM elements to the lookup table of named elements as targets. If you generate an iframe and want to POST to it from your programmatically generated FORM tag (by setting TARGET="your_new_element_name"), you're out of luck and IE will try to create a new window instead.

InnerHTML to the rescue. The abomination of standards that is innerHTML works pretty well across all browsers. John Resig is so right when he says the DOM is a mess. Thank god for things like jquery.

Developing Flash? Sick of the browser caching your newly published swf file? Turn off that cache.

Uncheck "Store common Flash components to reduce download times" in your Adobe Flash Player Settings Manager. I was getting sick of having to rename my flash swf file / try to reload my browser cache.

Strangely, the best way to get to the Flash Player Settings Manager is actually through the official Adobe website's help page, by clicking here.

Must-see for any web startup: Video of Matt Cutts explaining web blight and how to stop it

The Solved Mystery of the Crashing Starling

Starling is the simple queue server that backs Twitter, and Workling is the great queue framework by Rany Keddo that is built on top of Starling (and works with other queue servers, e.g. RabbitMQ). It lets you throw a job on a queue server, and have something consume those jobs on a different process / different machine. This is great for long-running tasks like sending emails, or creating denormalized data, which is what we use StarlingWorkling for.

But we ran into catastrophic crashes with Starling (memory use bloat over the course of a day to 1 GB of RAM, no longer responding to queries). At first, we were confused, and a restart of Starling would always solve the problem. This was fine since jobs that hadn't been completed get flushed to disk and re-read from disk with Starling. Starling is absurdly simple, actually -- it's just a modified memcached server that lets you "throw a job on there" -- it stores a job id, a hash object of parameters, and that's about it. Using the memcache 'get' command, the workling client de-queues the job (which destroys it from the queue), and using the memcache 'put' command your rails proc can put one on there. First in, first out.

After a while, we realized the problem was actually with the way we used Starling/Workling. Workling has a "return store" that allows you to pass a message back from your running queue that something is "done" -- or it can be used for progress as well.

The offending code was here, inside each one of our asynchronous worker code:
    Workling.return.set(options[:uid], "DONE")   

This looked innocuous enough. You want to be able to know when a given offline job is done, right? However, the Starling return store actually ends up just queuing another "job", with the key being unique to options[:uid]. But we weren't ever "de-queueing" that job -- meaning for many of our jobs we never retrieved the status of it, and it would always be stored and never destroyed. So thus, Starling was getting absolutely filled with these one-off return jobs (tens of thousands of them) throughout the course of a day. After a day or so, it would just giving up the ghost.

We swapped the code to this, and now we've had 100% uptime for weeks and weeks. Whenever we want to get done status, we also pass in the flag 'set_return_store' to true.
    Workling.return.set(options[:uid], "DONE") if options[:set_return_store]   

Thank God for open source -- if we couldn't dig through the source, we'd never be able to truly understand what was happening. That's one of the biggest lessons to learn when working deeply with open source: search Google, but when nothing comes up, be sure to read the source and understand what's really happening. Nobody's going to hold your hand through this.

XSS dangers: A classic reason to use image_tag instead of IMG tags in your rails view code.

This code seems fine in rails view code, right?

<img src="<%=@image%>" alt='<%=label%>'>

Wrong. What if someone drops this into your user generated content label?

"onmouseover=alert(document.cookie)

Bad times ensue, because users can inject their own evil JS that actually BREAKS OUT of the tag and run cross-site scripts. Always use link_to and image_to when dealing with user generated text. It'll automatically strip out text that otherwise would break out of the tag string. Special thanks to @Stephen on twitter for being a great security guru.