Securing Your Firefox

While its popularity suffers from a decline in the past year or two, Firefox is still a great browser which has a lot of things to offer. One of those things is the ability to control whether a plug-in will start automatically when the relevant content is being loaded, or should the browser ask for the end-user’s permissions to activate the plug-in on a per-site basis.

When can the above functionality be most useful? When defending against malware. The sad truth is that being infected via a drive-by malware is something that can happen to anyone, regardless the security measures being taken (e.g using Linux or OSX, having an anti-virus running or using a browser which is not IE). Due to the increased efforts in making it secure, Firefox has very little known vulnerabilities in the core browser engine, forcing the bad guys to opt for its plug-ins as the attack vector.

Unfortunately, Adobe (maker of Flash and Reader) and Oracle (maker of Java) are still doing a so-so job in terms of making secure software, thus it is recommended to have their plug-ins run only when the user approves them to run.

As a matter of fact, I’d recommend getting rid of Java and Reader entirely, yet Flash is still needed for many sites, thus cannot be discarded easily.

So how could one make Firefox ask for a permission to run such plug-ins? Easy:

1. Open the “tools” menu and choose “add-ons” (ctrl-shift-a for non OSX users).
2. Choose the “plug-ins” tab on the left panel.
3. Choose “ask to activate” for the not-so-secure plug-ins.
    

That’s it. Have a safe browsing.

Be specific with your python conditionals

Here’s a mistake in Python that I saw getting done time and again:

some_val = some_dict.get(some_key, None)  # the None is optional in this case

if some_val: do_something(some_val)

What’s wrong?

Usually, the person who writes such code wants do_something to run whenever some_value is not None, yet if some_val is an empty list, empty dict or even the number 0 - do_something will not run! The right way to do it is:

if some_val is not None: do_something(some_val)

alternatively, one can check

if some_key in some_dict: …

Both options are more verbose and will get the job done.

Alexa domain ranks in Python

After the 10th time that I've developed a similar capability, I finally decided I should create a public, open-source, Python library for getting the Alexa rank given a URL.
Even though it's not complicated, I imaging many people could enjoy such ability. Also, I'm open for suggestions if anyone requires enhancements.

I'm currently thinking about creating a Node.js web API which provides similar abilities, for those who prefer having this solution accessible in such a manner.

The code can be found on Github.

SQLite DB with Orange Data Mining

The following post has no agenda or moral. It's just a story about stuff I did at work and some code I published.

Not a long time ago I was requested to bring my data-mining knowledge back from the dead. The project is actually quite fascinating, something in the software security field, and it's a shame I cannot provide much more details in this blog.
Anyway, since budget is low, and I tend to prefer open-source solutions, I installed Weka and Orange on my machine. Since the raw data to be processed is stored in a SQLite DB and since I recall I had better experience with Weka - I went for the first.
After a few hours of breaking it and trying to get it to produce some decent classification rules, I gave up on it. I guess that the fact I now love Python more than Java (it wasn't always like that) had quite a serious weight on my decision to stop trying to get Weka to work, so Orange it is.

Unlike my previous experience with Orange, back when I was a student, I figured I should go with the core framework - no UI, only Python commandline and scripting using Orange's extensive data-mining libraries.
After refreshing my memory with the tutorials, I felt comfortable with it, yet I realized Orange isn't capable for handling SQLite DBs. Instead, it uses some of the industry's common file formats for data-mining, and TSV. Yes, TSV. But this shouldn't stop me, right?
Few minutes later, I had my first SQLite-to-TSV converter up and running. You can find the sources on github.

From here, everything was a breeze: some data fiddling, some algorithms threshold settings, and results started to appear. Cool.

Blogging for the .NET framework

A system I've been working on is based on the .NET framework. It seems that Mono and Apache on a web server is a pretty good combo, and I recommend everyone with a spare day or two to give it a try.

Anyway, I needed to run a blogging engine on that same server and have that blog support Hebrew and right-to-left languages. While there are several good blogging engines for .NET, not all would run on Mono and most doesn't do the RTL part good enough.
My first attempt was to use SubText, but getting rid of the SQL Server dependency and adding the RTL support became too much of a hassle. I picked SubText for it being notorious for its simplicity and elegance, but while I was ready to invest some customization time, it demanded too much of it.
My second attempt was BlogEngine.NET. What can I say - I fell for it almost immediately. The platform is versatile enough to support not only many RDBMS's, but it also allows storing the posts in XML files. Nonetheless, the translation to Hebrew wasn't complete and there was no RTL native theme for it. So I made one.

BlogEngine.NET is hosted on CodePlex and uses Mercurial for its source control. I had a fork of the project in no time, so I started making the required changes and created a new theme based on the default one. Since I don't want to maintain a fork of the project for eternity and since I want others to enjoy this new feature, I've sent a pull-request which was accepted yesterday. So starting from version 2.5.0.6, you can enjoy BlogEngine.NET for your Hebrew blog.

As always, it feels good to contribute back and to know that my code can be further enhanced by other developers.

Happy blogging.

Starting Mono Development In No Time

For anyone coming from the Linux world, getting up and running with a development machine is a matter of minutes. All one has to do is use his favorite package manager in a manner similar to this:
apt-get install mono monodevelop mongodb python...
And just sit back and wait.

But what do you do in those days when you have to use Windows for development? What if using a Linux VM isn't a viable option?
Enter Chocolatey.

Chocolatey is a superb open-source package manager based on NuGet which brings the benefits of package management, including keeping your software up-to-date, to Windows. Due to its core, I believe that it was initially targeting .NET development, but this is not the case anymore. Among the packages I install are GnuWin (because you can't live without the GNU command line tools), node.js, mongodb and python. Obviously, one can use it to install Mono and MonoDevelop.

I believe that with the great community that has started to evolve around Chocolatey, the repositories will grow richer and into more areas, and Windows development would become as fun as Linux development.

Enjoy.

Creating Wireframes with Pencil

When working on a project which requires a user interface, it is usually best not to jump ahead and start programming the UI part before making some sketches first. It makes sense, since UI development shouldn't be different than library/API development. The client is different, but the principals remain.

For a long time I've been a Balsamiq Mockups person. I know, it's not open source, but they'd used to give licenses to those who blogged about it. Also, few years ago, Balsamiq was far superior to other solutions and it contained much needed features.
This is not true anymore. For the past few months I've been using Evolus Pencil and I can tell you it's great. First - it's open-source. Second - it has ports to all platforms and can also run as a plugin for Firefox. Moreover, it is customize-able, extensible and very flexible.

So if you've decided to give Pencil a try, here's a tip that would make your wireframes look a bit more serious and professional: right click the "Sketchy GUI" collection in the collections tab, and select "Collection Settings...". Navigate to the "Text" tab in the resulting dialog, and change font family from "Comic Sans" to a font that you might actually use for the final product.
Want another tip for general wireframes design? Don't ever use "loren ipsum" as a text filler. Wireframes should be later translated into real UI and graphics design, so you don't want to find out that that text area you've been designing doesn't fit the needs of your application. Always wireframe with real data.

Those were my two cents for wireframes using open-source software. Hope it helped.

Using App.Config in IronPython

I love python very much, and as you probably already noticed, I love C# as well. I already have many libraries and utilities developed in those languages, and for me, the ability to reuse code between those languages, is a must.
So I came to know IronPython, which is a complete Python implementation for the .NET platform, using the DLR. For most of the time, the integration between the two is a breeze. All you have to do is "clr.AddReference" your .NET assemblies, and you're good to go.

Unfortunately, with more complex projects, there are some caveats. Most notably is the missing ability to load app.config (or web.config, or any other .config) files from IronPython. Without diving too much into details, the reason is the way AppDomain works in .NET. It is looking for [assembly name].config file when one is requested using the ConfigurationManager. Since IronPython code is invoked with ipy.exe, the configuration file must be called ipy.exe.config. I suppose the same goes with IronRuby as well. This is a serious limitation.

Thanks to Tom E. Stephans for providing this awesome proxy for the ConfigurationManager. Basically, his code injects some logic to the inner workings of the ConfigurationManager, that allows us to specify which config file to be loaded. This config file will be seamlessly loaded by the ConfigurationManager when needed.
Unfortunately, Tom's code doesn't exactly compile. Probably due to some copy-paste issues he had when publishing it. So I did some minor modifications, and removed the part of the code responsible for loading custom configuration sections and uploaded it to Bitbucket, so everyone can use it. The code is available here, along with a sample usage python script.

Few things to keep in mind regarding my code:

• It was compiled using Mono 2.10 like this: mcs ConfigurationProxy.cs -t:library -r:System.Configuration
• It was tested both under Mono and under MS .NET framework 4.0.
• There's a sample config file called blogsample.config which contains a demo connection string. This configuration file is loaded in test.py and the connection string is printed.
• Just like the ".ConnectionStrings" collection is accessed, one can access the ".AppSettings" collection.
• Since the injection is done to the ConfigurationManager, implicit usage attempts will also work. For instance, the SubSonic ORM which requires a connection string, will work seamlessly.

Once again, kudos to Tom for his great work. I hope you will find my corrections and sample useful.

TRouBLe is Useful

Web programmers have probably seen this a lot:

margin-top: 10px;
margin-right: 20px;
margin-bottom: 10px;
margin-left:20px;

The reason many programmers "need" 4 lines of code for such a simple thing, is that it's impossible to set the margin (margin is just an example, since this is also true for padding/border/...) to 20px, and then override just the top margin. But isn't there a better way?

Well, there is a shortcut for the above:

margin: 10px 20px;

Shorter, heh?
The parameters for attributes such as margin, are specified in this order: Top Right Bottom Left, or TRouBLe for short. CSS parsers are smart enough to apply the last specified parameters, to those that were omitted. So in the above example, I've omitted bottom and left, so the 20px value would be applied to those as well.
The general rule is:
* if only one value is specified - it is used for all (top, right, bottom and left)
* if two values were specified - the first will be used for top and bottom, and the second for left and right
* if thee values were specified - the first will be used for the top value, the second for the left and right values, and the last for the bottom value
If I wanted to set the margin-left to 10px, I'd have to write this "long" statement:

margin: 10px 20px 10px 10px;

Which is still shorter than the first example above.
Many times, the shortened syntax can be used, and save us some typing while increasing the expressiveness of CSS attributes.

EDIT: It seems I messed up a bit the order in which things are shortened. Thanks for Tomer for correcting me. I've updated the post accordingly.

Installed Apps Doesn't Show in Market

Today I noticed an annoying bug in the Android Market application: it showed only 3 applications under the "my apps" section in the market, even though I have over a couple of dozen installed.

Rebooting the device or removing the SD card didn't help.
Being rather new to Android, I was tempted to remove the market application, and reinstall it. But Android is much like Linux, and much less like Windows, so reinstalling an application would probably retain the old settings.

And then it hit me - the settings. Why not reset those?

Simply go to: settings -> applications -> manage applications -> market -> clear data
That's it. The next time the market app launches, it will rescan the installed applications, and everything will be fine again.
That's pretty robust, even though it's in a geeky way, since I don't expect most people to do that.

Best Windows Development Environment

I know, this one is going to sound a bit crazy, but hear me out. IMHO, the best Windows development environment is Linux.

First, let me start with a less surprising statement: the best way to run a Windows installation is on a VM. This should make perfect sense to anyone who runs Windows on a daily basis, and knows that as time goes by, it simply gets slower.
No registry or other cleaning utilities can return it to run as fast as it was the day you installed it.
Moreover, when one wants to test a new piece of software, the VM's snapshot feature really shines.
So, every once in a while, one can revert to the a stored snapshot, and get an almost fresh Windows installation, almost instantly.

When it comes to development environments, where one rarely install tools, and the code is managed in source-control, reverting to a snapshot is even easier.

My second point is: use the host environment that you feel most comfortable with. In my case, it's Linux. Specifically Ubuntu. If you prefer running a Mac or a different Windows as the VM guest, it's OK as well. But I can assure you that after giving Linux a trial period as the host OS, you'll find it the most pleasant one.

Moreover, if cross platform compatibility is an issue for you, having Linux *and* Windows running simultaneously, is a great advantage and a real time saver.

C# Extension Methods

One of my favorite features in C# is Extension Methods. Let me explain why.

Did it ever happen to you that you needed to add a method to a class you cannot edit, and inheritance couldn't help as well?
This can happen in various opportunities, especially when working with libraries and SDKs that uses a certain class for its internal operations, and exposes this class to the user as well.

In such cases, in languages that doesn't support extension methods, the only way to add functionality to that class, is to write a "helper" class or method, and use it.

C# Provides a better way.
Let's say you have a blogging system, and you have a blog summary page, that displays only the first 100 characters of each post, as a teaser. There could be many ways to get the shortened text, but image you could have your own String class, that provides a method that displays the entire post if it's less than 100 characters long, and displays only the first 100 characters and "..." if it is longer.

Have a look at the following extension method:

public static class StringExtension
{
        public static String ShortenText(this String str, int length)
        {
                if (str.Length > length)
                {
                        return str.Substring(0, length) + "...";
                }
                return str;
        }
}

Simple. This code needs very little explanation. All it does is create a new extension method for the String class that implements the logic described above. Here's a sample usage for this new method:

Console.WriteLine("12345678".ShortenText(5));

The output of this would be "12345...", as you'd expect.

The possibilities of extending built-in classes provided by C# and the various libraries, such as ASP.NET MVC, are endless. Just make sure you don't abuse it.

The full source code of the sample given above is available on my bitbucket samples repository. It compiles on Mono as well as on MS C# compiler.

Ubuntu 11.04 and Unity

For a long time I've been a 10.10 user. Probably too long. To tell you the truth, I couldn't care less. Everything was so customized to my own needs, and everything worked perfectly.
Moreover, since most of my development nowadays is done on a Windows box, I didn't feel the urge to try something new on Linux.
Finally, there were so many bad reviews about Unity, and "thanks" to those I had second thoughts about replacing the desktop environment.

Last week I took the "risk", and you know what? I love it!
I had 11.04 installed both on my workstation and my laptop, and I can easily say it's one of the best Ubuntu versions I used.

On my laptop, I rarely connect a mouse, and I hate touchpads. This means I use the keyboard almost exclusively. Unity seems to be adapted to this, so it provides great keyboard shortcuts. Now I need the mouse even less.

On the workstation, even though I have a big screen with a "big resolution", I always try to find the best utilization for the screen space real-estate. If you ever seen a those 30" mac wide monitors that have the mac dock dragged to the left edge, you know what I'm talking about.
Unity also knows what I'm talking about.

Also, performance is great, as ever. Far better than using Windows. Ubuntu never misses this one.

I wish I didn't wait so long to try Ubuntu 11.04 and Unity. On the other hand, since this version is quite mature, there's a chance I saved myself some of the glitches and bugs it had 5 months ago.

Home Mercurial Server

I hope I'm not the only one who had this problem:
I've been working on some code demos and web designs and wanted to having it under source control, so I could keep track on changes, work from multiple computers and generally have a backup for everything.
For normal projects, I guess this should be done as an open-source project on bitbucket or github, but in some cases it's simply more convenient to have the repository at home.

So, I installed a Mercurial server. Want to know how?

The only thing you'll need is the Mercurial installation for your favorite OS (yes, Windows included). After installing it, run

hg init RepoName

this will create a repository called RepoName under the current directory.
For the next part, I'll assume the server is accessible only inside the home network, and there's no need to configure extra security measures. So, create a script that servers this repository inside the the repository directory:

hg serve --config web.push_ssl=No --config "web.allow_push=*"

All you have to do now is to schedule this script to run on boot time.
Now, from any machine on the network you can use commands such as:

hg clone http://ServerName:[probably_8000]

to work with your new Mercurial repository.
That's it.

Having a "development server" can be very handy, as it could also hold other documents (NAS functionality), personal wiki, local deployment server, etc.

Twitter - part 2. Android.

Twitter

So my Twitter 30 days challenge is about to be over, and I think I'm ready to summarize it and write some conclusions:

• I'm following 17 people, and have 9 followers. Only recently I began to gain an audience. Just like with blogging, it takes patience and persistence.
• So far I made 43 tweets. I'm pretty pleased with this number.
• Except for once or twice, all of the replies to my tweets were done on Google Buzz, which is connected to my Twitter account. That's pretty lame, and makes me want to lock both services - more on that, later.
• Tweeting is fun. I didn't think I'd say that.
• The TwimGo client for N900 is great. The official Twitter client for Android is just perfect. Not having a Twitter mobile client renders is useless. This could be another reason for Google Buzz failure, as it doesn't have a decent mobile client.
• 140 characters limit makes a lot of sense when posting from mobile. Longer than that is cumbersome. When posting from PC - it's too limiting.

So, am I going to keep using Twitter? For following people - yes. For replying to people - yes. For publishing stuff - probably no.
I guess most of the stuff I publish today on Twitter, will be published to "public" or "extended circles" in Google+ instead.
This means that my short "romance" with Twitter will probably end soon. While it's a lot of fun, it provides little gain compared to Google+. Perhaps had I joined 2 years ago, I'd stick to it until I know my followers would follow me to Google+.
It doesn't mean I'm going to generate too much noise in Google+ either, since I believe posts that complains about the Israeli heat will probably be published only to "Friends".

As a final note for this topic: I just removed the Google Buzz tab from my GMail and disconnected all of the accounts associated with it (Twitter, Google Reader, this blog). Since I never bother looking at the Buzz tab in Google+, this means I will ignore everything going on in there. I don't see the point of having a place where I need to follow people's comments on stuff published in other places. Comments for this blog should go here. Comments for Google+ should go there.


Android

This week was a happy and sad week in terms of mobile devices. Not sad as in tears, but somewhat sad. After 10 years of owning 5 different Nokia devices, I switched to a brand new SGS2 running Android Gingerbread. My last Nokia device was the N900, which is by far the geekiest toy I ever owned. No other smartphone can be tinkered by modifying things under /etc, and get updates using apt-get. A truly open-source device.

In the past few days I had very little time to dig into Android. They say it's Linux. IMHO, it's barely noticeable. No glibc, different filesystem structure, etc. I learned about odex, kernel versions and other fun stuff that will surely waste (in a fun way) many hours of my time in the near future. Can't wait.

P.S - if you want to follow me on Google+, you can use gplus.to/mosh. I don't know how long this link will last, though I hope forever.

Why I Love C# and Mono?

Let the comments in the code do the talking.
--------------------

using System;
using System.Collections.Generic;

public class Iter
{
    public class Book
    {
        //short way to declare a property:
        public string Title { get; set; }
        public string Author { get; set; }
    }

    public static void Main(string[] args)
    {
        // implicit type, yet still a strong type:
        var books = new List<Book>
        {
            // inline initialization:
            new Book { Title = "Book1", Author = "Moshe" },
            new Book { Title = "Book2", Author = "NotMoshe" }
        };
       
        // closure, lambda expression:
        books.ForEach(book => Console.WriteLine(book.Title));
    }
}

--------------------
Did you know C# has all of those cool features?
This is why I think that even if you're not going to write code in C#, you should get familiar with it.

Needed: Ruby/Rails Developers in Israel

I just read Ido's great post, and couldn't stop myself from writing a response post.

Basically, what we have in Israel is a chicken-and-an-egg problem. Why? because there will be no Rails programmers if the market (=big # of companies) would require it, and no company would shift to Rails development if there would be no developers to make it do that.

The problem starts in the way developers are "born" in Israel. They are either:

1. become developers during their service in the IDF - no Rails there.
2. become developers after a relevant academic degree - AFAIK, no Rails there either.
3. become developers in different ways, most of those would try and learn technologies which are required by the market. The remaining few that would bother learning Rails (or Django) are probably those who also read this blog.

I think that in the US market, especially in the Silicon Valley, this is not the case. Developers there are educated differently and are much more likely to be exposed to Rails. The only Rails developer I know - learned it while working in the Valley.

Here's another one for you: how many Israeli web-hosting companies do you know that supports Rails? How many for PHP/Java/.NET?

So, even if I'd try and develop a Rails application for the local market, I'd have to host it abroad, which is a shame.

A while back I did a short survey regarding the buzz around Rails development and other web frameworks. Check out the replies. How many chose Rails?

Finally, I must admit that I'm no better. I had a chance to choose Rails recently, but didn't. Sorry, I couldn't find others whom I could hire if needed.

.NET MembershipProvider with MySQL

If you're a .NET developer (Mono or MS, doesn't matter) and an OSS enthusiast, then you're probably using the MembershipProvider provided by MySQL instead of the default MS provider for MS-SQL. The MySQL MembershipProvider comes bundled within the MySQL Connector for .NET.


In certain configurations, one can expect various bugs related to the MySQL Connector, especially with the latest version of MySQL Server and/or Windows and/or IIS. The most annoying thing about such bugs is that they don't introduce themselves on a development machine (different web-server, different OS, etc.).

My latest bug involved getting NULL for Membership.GetUser calls, even for logged in users. The bug  would occur inconsistently, which made stuff quite hard to debug.
The solution? simple - always use the latest version of the MySQL Connector.

This is why I always plan the first-time production deployment to take a few days. You can never tell what will go wrong.

Nokia, What Went Wrong?

I've been using the Nokia N900 for a week now, and it made me wonder: how comes there are no more Maemo based devices out there, and how comes Nokia's CEO states they're standing on a burning platform?

The N900 hardware is great, yet nowadays it doesn't stand out. Other companies produce hardware with the same quality. It's the software that makes all the difference.

The Maemo platform should appeal to every nerd and every software developer, as it is based on Debian, and porting applications to it is so simple.

As a result, it is capable of running some truly amazing applications, such as Firefox (including addons) and games that were ported from the PC.

I've set up a dual boot with Android, so I could compare stuff, and access applications that aren't available for Maemo. And although there are quirks in the Android (NITDroid) port, it's successful in providing the full Android experience. And you know what? I don't use it. There's no point in booting into Android when everything can be easily done with Maemo, and sometimes even better (like having a full, real, browser).

The two apps I do miss, though, are Shazam and Waze, and I believe that had Nokia continued developing the Maemo platform, ports of those apps would've become available as well.

Some of the best things I find in the device are:

• Integrated IM/VoIP with Skype/GTalk/MSN/FreeTelecom/Jabber/etc.
• USB Host.
• Really useful desktop gadgets, and not plain icons that represents apps.
• DLNA.
• apt-get.
• A full, real, browser. Renders everything exactly the way the desktop Firefox does, including flash.
• QWERTY keyboard.

and the list goes on...

So my question to Nokia: why did you stop developing this platform?

Sometimes IE/FF renders fine, and Chrome doesn't

Twitter style post (125 characters, not including this header):

After two hours of head banging on a bug in my HTML/CSS being rendered differently in Chrome, it appears it was a Chrome bug.