Eddie's blog won't bomb you with updates

4 years on, still love every bit of it

Eddie — Thu, 08 Jul 2010 23:10:20 +0000

To quote abigor on slashdot

In all fairness, no platform is perfect, let’s face it. You seem to be commenting on OS X (hard drives, 3d performance, etc.), so let’s see:

If you want non-working cut and paste (the general case is it only works for text), no 3d performance at all, barely any wireless support, no commercial software support including de facto standards like MS Office and Photoshop, no games, amateurish and inconsistent guis, etc. ad infinitum, then run desktop Linux.

If you don’t mind a pretty substandard operating system in return for all the software you could ever want and you don’t need Unix, run Windows.

If you want a usable, well thought-out desktop Unix with lots of commercial software (though much less than Windows), good open source and open standards support, and you don’t care about games, run OS X.

As cliche as it sounds, it’s all about what works best for you.

It has been almost four years since I first moved my personal computing to Mac OS X – during the tiger years – and I have enjoyed every bit of the experience. After two more major OS releases and several flawless “migration assistance” experiences, I find I have had a reliable platform I could accumulate personal data over years. Long gone the old time of messing around custom Linux kernels, crafting scripts to migrate data from mbox to maildir and building custom .deb to enable 3D effect in my favorite window managers. Though I’ve had some fun and killed some lonely moments, this constant dissatisfaction with the system and nonstop changes to it not only are distractive but also put my valuable data in refugee status all the time. At the end of the day, computer is just a tool. Enjoy many years of photos well organized in iPhoto and ready to be used in whatever document you are creating; have a short coffee break after unpacking your shinny new iMac 27 before the system is ready to be used with all your settings and data automatically migrated in an hour; or fire up Terminal.app, MacVim and Espressor and get some work done.

I am not with Adobe

Eddie — Sun, 11 Apr 2010 02:48:01 +0000

It seems everybody has weighed it in with this controversy about the new Section 3.3.1 of iPhone SDK agreement. This change effectively bans the use of “applications that link to Documented APIs through an intermediary translation or compatibility layer”, which nullifies Adobe’s upcoming Flash-to-iPhone conversion tool.First, Adobe was angry, really angry. In its official Flash blog, concerned that their sentiment would not be loud and clear enough, it said out loud, “Go screw yourself Apple“. It is not a surprise to see Apple bans Flash on iPhone OS, and everybody hates Flash – at least everybody on non-Windows platform does – and would typically show no sympathy when Adobe cries about it. And, gee, not a single one has built any iPhone application with this yet-to-release feature to convert Flash content to an iPhone app, and who but Adobe cares about that this change of SDK agreement would ban this feature. However, it was tacky that Adobe by pointing out this would affect not only Adobe but also Unity3D – it might not be true, since Unity3D works as a precompiler – was able to unite a big force of outraged developers. Over 2,000 has joined the facebook group named “I’m with Adobe” in support of Adobe. Considering this group also said Apple’s next move was “banning bands from iTunes who used PCs to mix their albums”, I would not believe anything they would say. Unfortunately, Adobe was surely committed enough to steer online discussion and to generate a huge wave of sentiment against Apple and App Store across the blogsphere. Protesters with the revenge-kind or adandonism tones are everywhere, and it is extremely difficult to find anyone with any insight. But I believe this is not like it appears from seeing the blogs and comments.

As always, slashdot community has better discussions worth reading. One slashdotter pointed this interesting point about history:

Although I strongly condemn Apple’s bullying tactics, I can only say that Adobe had this coming for a long time.

Back in the 80s, at the dawn of desktop publishing, Apple held a kind of symbiotic relationship with Adobe, Aldus, and Macromedia, the once-competing companies that eventually merged into today’s Adobe. But somewhere in the late 90s Adobe started to drop the ball on Apple as they saw greener pastures in Windows Land. They started to invest much more in the development of the Windows versions of many of their products and Mac versions started to become second-class products.

Adobe even used Premiere as leverage against Apple, threatening to stop its development for the Mac, something that would have essentially kicked Apple out of the video editing market. That’s why Apple bought and started heavy development of Final Cut (1999?). Adobe in fact pulled the plug from Premiere (2003?) until they realized that this has backfired on them making them loose a lot of the video market (2007?).

But perhaps the epitome of Adobe’s contempt for Apple is Flash. if you think Flash for windows is crappy, you haven’t seen the Mac version (or for that matter the Linux one). Macromedia Flash was equally good for Mac and Windows, but while the performance of the Windows version was kept almost acceptable, the Mac version became even more sluggish, processor intensive, and buggy.

Furthermore, Flash became probably the biggest security hole in Mac OS X. in the security update for January, 12 vulnerabilities were plugged. But seven of them were not really in the operating system but in the flash pluggin!

If I was Apple, I would also be very concerned that Adobe, with its Army of Flash developers and its crappy implementation of Flash platform, would soon flood the App Store with apps, which arguably would be alien-ware and sub-standard. I believe the original iPhone developer community would be a minority by then. iPhone SDK would soon be irrelevant. Adobe would effective take control of the platform. The cross-platform nature of the flash platform would mean Apple would be at Adobe’s mercy to remain in the smartphone business. And if history is any indication, Adobe would not play nice by then. And it has already turned its back on Apple, as one pointed out

Many of us who do have noticed a distinct shift in [Adobe's] design philosophy away from making a Mac program for graphic designers towards making a PC program for graphic designers which happens to run on the Mac. The examples are small yet numerous and it paints a clear picture, to anyone who actually thinks about it for a second, that Adobe was the first to turn their backs on the Mac community. I believe there’s been a cold war brewing behind closed doors for years now and, while Apple may have been the most obvious about bringing it into the light, Adobe was the first to act on it with their shift in design philosophy with CS3.

That reminded me the time when Microsoft had to hijack the Java development on Windows with its own JVM and Visual J++. It’s either Java destroying Windows or Microsoft destroying Java on Windows. It looked evil, but at least Java was something nice and worth looking at especially in those years. But with Flash, Apple could easily ban it without losing much, as one pointed out

If Adobe want to play, they need to bring something that excites the user-base, and that Apple can’t refute. So far they’ve *not* done that, and childish rants aren’t going to persuade me that they can, in fact, do that. I do love the “comments are disabled because someone might disagree with me” as well [grin] – that just smacks of someone firmly convinced they’re in the right…

And after reading the following comment, I really think it is time to forget about this whole discussion and move on.

You know, everyone keeps complaining about all this “control” apple has on the iphone. And now, to read how they are worse than Microsoft.

First, Flash sucks for me as a user so I am thrilled it’s going to die. Sorry if a few developers love it, but that’s not my problem nor do I care if they have to learn new things. Thank you Apple.

Second, as an iPhone user there is nothing I miss on a daily basis being able to do with the iPhone. Do I wish that there was more flexibility with some apps? Yes. Do I think it’s this huge deal, no. Fact is the control Apple is doing has benefits and negatives. For most people the benefits of a closed community, screened apps that haven’t had viruses or malware, and a wonderful intuitive GUI (IMHO, Android is getting closer but is still not consistent nor as intuitive as iphone or Palm WebOs) and easy upgrades that actually are released to the phones (as opposed to the fragmentation that’s Android) is worthwhile. Fact is Android Droid are STILL waiting for Verizon to let them get 2.1 of Android. How’s that for control? If you want control, get yourself an out of contract pay as you go GSM type phone (like the Nokia or somethiing). But for the rest of us people who just need a smartphone and not a portable computer, the iphone is a great device.

Oh, for the record, I am not with Adobe, solely because their applications do not live to my standard.

Finally found those websafe fonts, sort of…

Eddie — Thu, 04 Feb 2010 01:53:06 +0000

My job involves creating web pages, and though that does not mean I need to make them beautiful, I sure like to make things look nice. Ever time I come across some magazines and especially those well-designed advertisements in them, I wonder to myself, “man, I wish I could use those fonts for my websites.” Unfortunately, it would always end up with disappointment, especially in the days when my boss was sticking to Debian with its very limited default collection of fonts. Though everybody in the lab has since switched to Mac, making sure things that look nice look equally nice for most of our users would still limit us to very few options.

That’s changed by web typography, and for me, by a neat website called typekit, brought to us by a small startup called Small Batch. The same talented team was behind the acclaimed Measure Map, better known as Google Analytics since Google acquired it. With CSS 2.0 providing features to enable web typography, typekit fills the gap of commercial font distribution. If the Web is a platform, then typekit is the /Libary/Fonts. By patching your webapge on the fly using JavaScript, typekit tries to be unobtrusive as possible. And you won’t get your hands dirty by writing those patchy JavaScript, as typekit provides a very friendly editor to express how you want to dress up your page with its collection of hundreds of nice-looking fonts in its library. Oh, yes, you can try it for free for an unlimited time.

Centering a block using CSS

Eddie — Sun, 17 Jan 2010 21:06:09 +0000

Many times, I’ve found myself in the need of a solution to center a block in a webpage. This problem is complicated if the parent block has a variable width, for example, when the parent block is body. In the past, I used the trick of negative margin. For example, if the block has a width of 500px, I would do:

.centered-block {
  width:500px;
  margin-left: -250px;
  position:relative;
  left: 50%;
}

The negative margin puts exactly half the block off the left border of parent block, effectively aligning the center of the block at the left border of the parent block. Moving the block to the right by 50% will now place the center at the center of the parent block. The combination effect of the two is that the block is center aligned to the parent block.

I sometimes see undesired horizontal scroll bar when using this method, possibly due to the last line in the CSS code, which could potentially increase size of the canvas.

I have found a better solution that uses inline-block. The corresponding code for the above scenario using inline-block can be:

.parent-of-centered-block {
  text-align:center
}
.centered-block {
  width:500px;
  display:inline-block;
  text-align:left
}

Using this method, I have never seen undesired horizontal scrollbar. There is an extra benefit. You could now eliminate the width property if you want the centered block to have a flexible width, meaning it can be as small as possible but grow when necessary to accommodate content in one line if possible. In one of my cases, I wanted to place a line of several icons in the center. I removed the width property, and let the block to figure out its best width by trying to put all icons on the same line. See it works in a real case.

Poor man’s daemonizing scheme

Eddie — Tue, 20 Oct 2009 18:50:33 +0000

About a year ago, I wrote about daemonizing some python script for a web application. Today I encountered similar problems when I was fixing some migration issues when we retired an old server and moved some services to a OpenVZ container. Technology moves fast. What was large now has become small. Data that would have required a dedicated computer cluster to crunch years ago would now be processed quite comfortably on a single virtual machine. We decided to replace our qsub-based approach by running the job locally. It was as simple as replacing the qsub command by bash, plus the extra effort to daemonize the script so that it won’t hang our web application.

Looking for a quick fix, I thought about nohup. After a failed attempt, I discovered a recipe to make it work flawlessly. That is so simple and handy, and can replace become_daemon in django.utils.daemonize for many of my needs.

I am loving snow

Eddie — Thu, 24 Sep 2009 15:33:31 +0000

Coz it’s light!

Caja and JavaScript Security

Eddie — Tue, 04 Nov 2008 01:01:40 +0000

People have been worrying about cross-site scripting, and have been careful in dealing with user input data, typically by filtering out undesired HTML elements. There are now certain applications that cannot afford to filter out user-generated scripts, such as gadgets in iGoogle and OpenSocial, and facebook applications. These applications must run user-submitted JavaScript, often inside the same webpages that are linked to very sensitive information. It would be a disaster if iGoogle gadgets get access to your GMail account, or a facebook application access your profile when you don’t want it to.

The sandbox feature of JavaScript language was not designed to handle this situation. IFrame can offer desired isolation of untrusted code, if you do it carefully, but it offers no granularity in control and it cannot stop some behavior such as redirecting page and initiating installation of plugins. Caja, which stands for capability JavaScript, is an emerging technique to “put untrusted third-party HTML and JavaScript inline in your page and still be secure”. There are similar offerings like Facebook’s FBJS, ADsafe, and also Microsoft’s Web SandBox. Similar concept is also applied to other programming languages.

What’s new in Python 2.6

Eddie — Sun, 12 Oct 2008 21:40:12 +0000

Full release notes are here. Here are something that catch my eyes.

with statement with is a statement that simplifies the task of elegantly acquiring and releasing resources, and moves the task of handling exception to the resource manager author. For example, the file object now supports with statement, and when using this statement, the job of closing the file on regularly releasing the object or on an exception will be the task of the file object itself. It also makes locking/unlocking a resource amazingly intuitive, by moving the real (and repeated) job to the resource manager author.
per-user site-packages. Without this, I have always been making my own per-user site-pacakages. Handling different versions of packages for different Python versions is not an easy task. Now it’s automatically done. No need to sudo when installing a package!
multiprocessing package. I have had some very bad experience with Python’s threading module. Python threading is useless in many cases when your code enters a chunk of time-consuming C code: even when the C code is blocked by I/O, the other Python threads will not be waken up if the C code is not Python-aware. This issue is made worse by the infamous GIL, which means your program will always be executed serially no matter how nice your multi-threading code skill is or how many CPUs you have. Multiprocessing is way out of this, though it consumes a bit more resources. It also has the advantage of being transparently distributed: you can run multiple processes across a cluster of computer very easily.
Advanced string formatting. Now you can have many nice features found in Django‘s template engine.
print is now a function. This allows you disable all prints in your program by redefining it. I was typically too lazy to use the logging module for debugging purpose, and now this change to print saves me some time from removing all debugging print statements. While, logging is still better.
New I/O library, which looks so similar to Java’s I/O library.
Abstract Classes. Now if you want to build some extensible/customizable software, you have an easy way to specify which methods must be defined instead of just saying it in the document.
fractions module. I like Python’s support for long integer, decimal and now fraction data type. double is evil in many cases despite its efficiency.
json module is now part of Python standard library.
Now both md5 and sha modules have been removed. Use hashlib instead.

Quickly secure CentOS 5 by enabling sudo, disabling root, and limiting access

Eddie — Tue, 30 Sep 2008 17:54:55 +0000

CentOS differs from many other distros by enabling root account during setup. I prefer the Ubuntu’s (and OS X’s) way of using a separate admin account and having root account disabled. When there is a need to perform administrative task, just run the command with sudo and easily prevent the risk of abusing root privileges and doing stupid things. Following this guide, I was able to make this work on CentOS.

First, log in as root account. You can switch to root account from any account by running su and typing the root password.
Enabling sudo. If you are not comfortable with vim, run
```
export EDITOR=gedit
```
first. Now run
```
/usr/sbin/visudo
```
The lines starting with # are comment lines and will be ignored. Just uncomment the following line:
```
# %wheel  ALL=(ALL)       ALL
```
by removing the # at the beginning. This line means that anybody in the group wheel can use sudo to run anything from anywhere.
Add an account to group wheel. For example, if the account you use to perform administrative task is isteering, run
```
gpasswd -a isteering wheel
```
Now you can sudo from user isteering
Disable root account. This is done by running passwd to lock the account:
```
passwd -l root
```

It is quite obvious after we perform the above steps, we have just created a second root account: the user isteering is exactly the same as root user, just having a different name. So we have not added much protection, if the attacker can guess the name of this new account. So you might want to consider limiting where the user can log in from. Use your favorite editor to edit file /etc/security/access.conf. Add the following lines for the admin group:

-:wheel:ALL EXCEPT LOCAL 192.168.1. 72.14.207.99

This will deny user in group wheel to log in from anywhere but 192.168.1. subnetwork (note the suffix dot) or host 72.14.207.99. You still need to add this line

auth       required     pam_access.so

to /etc/pam.d/sshd to tell SSH server to consult the access control, otherwise SSH server by default will ignore this access control mechanism built in PAM.
References:

More advanced information on PAM
A python module to access PAM

Comparison of Android and iPhone SDK

Eddie — Thu, 25 Sep 2008 17:31:19 +0000

In developer-friendly versus customer-friendly, the author made a really good point about Apple’s controversial stance in many of its recent decisions.

A follow-up made it even clearer using OS X application development as an example. Though I still prefer to code in an environment that is developer friendly, which I think both Linux and OS X are (at least for my quick prototyping needs), for real-life applications I depend on, I’d appreciate quality of Apple products.