Ideas & thoughts from one highly caffeinated dude

Simple Ruby Script for Source Code Reviews

2009-12-03T15:40:00.000-08:00

Early today I wrote a simple script to help me get up and running quickly for source code reviews. You can check it out at http://github.com/medelibero/CodeReviewTools. It is nothing too special but it will save me a little bit of time. The only dependency for the script is the spreadsheet gem which can be found at http://rubyforge.org/projects/spreadsheet/. The nice thing about this is that it doesn't require OLE so you can run this on OSX and Windows and maybe even linux (I didn't try that OS).

Well I hope this is helpful for someone else, which is probably why I am posting it here :).

Weird Outlook 2007 Image Cropping

2009-10-20T06:54:00.000-07:00

One of my clients recently added a third image to a newsletter they send out. This image like the other two was 120 pixels wide by 600 pixels high. Everything was all fine and dandy until one of them started to have issues with it displaying correctly in Outlook 2007. After a bit they called me into look at it, it was a fun little issue and during this time I found a rendering bug that is pretty annoying in Outlook 2007. This post hopes to explain the bug so other people can realize that it exists and work around it.

Background:

For Outlook 2007 Microsoft decided to switch from using Internet Explorer to render the display of the email to Word which was being used to compose the emails. I understand why they did this: removing dependencies, less security risk, blah blah blah. So, I don't think they are stupid for doing it but this bug is kind of an annoying corner case. Anyways, throughout this article remember that Word is being used to render the damn email.

So a setup for the email:

1) It was an HTML email

2) Like most HTML emails I was using tables for the layout because email clients are pretty far behind how browsers work

3) There was one column with three images that where all 120 x 600

Below is a rough layout of the email template -

As you can it should not be too hard, right? This is how Outlook 2007 renders it:

Wait why is there that huge ass gap?! The problem lies in the fact that Outlook messes up rendering when you have a table and a total of 1800+ pixels in image height. Remember how I said Outlook was using Word for rendering? How does Word work? It uses pages right? Which is actually the problem if you took an email setup like the one described above and put your cursor a little above the third image you would be able to drag around the page divider, sigh. How it works is that if all of the images can't fit into one page it will take the next image and move it to the next "page." Which screws up the layout of the email, nice....

During this whole process I thought of a few different hacks like what would happen if I put in a really large image like 1,900 pixels high could I force Outlook to expand the page? Nope! Here is a screen cap of an email with a large image in Mac Mail and in Outlook 2007.

Outlook 2007 is on the left and Mac Mail is on the right. I could have replaced Mac Mail with Outlook 2003, Mobile Me's web renderer, gmail, etc... If you look at the large image you will notice that Outlook 2007 has eaten the first 150 pixels of the image. You can even replicate this issue by creating a two column table inserting a large image (1900 pixels high) into one of the columns.

Well hopefully this explanation will prevent some head banging for other people. Now I need to get another cup of coffee.

Lessons Learned From Going on My Own

2009-09-09T09:39:00.001-07:00

I have been "on my own" as a freelancer for the last 2.5 months and I wanted to record some of the lessons and observations I have had in that time. My situation is a bit different (although I am sure I am not in an absolutely unique situation) than from what I have read in related articles. First off what makes mine a bit different? Two things:
1) I was moonlighting for the past 5 years so I had time to build up some recurring clients
2) I focus on development and application security (instead of one or the other)

So what have I learned?

1) Cash flow is king - very common saying but when you are on it really hits home. If you don't have enough money saved up to take on a longer-term project you can miss out opportunities (yep, I didn't have enough saved, sigh).

2) People don't give a crap how busy you are - People just want their stuff done and they don't care if you have been thriving on 4 hours of sleep and have 50,000 other projects going on you should have scheduled better. This is something I knew already but once again it really hit home when I went on my own. There is a bit of truth in both sides of the coin on this, scheduling your work load is important but clients can also be pretty demanding (if you let them be).

3) Plan for 4 to 5 hours of billable time a day - I heard this but I thought people were full of crap. I planned out my hourly rate for working 8 billable hours. This was stupid! Like head slamming against the desk stupid. I would even say plan your billable rate for 3-4 hours a day and be done with it. I work more than 3-4 hours a day but that cushion for crap days and other shit is just a good idea, imho. So, how long does it normally take me to work 8 true billable hours [note: composing an email, reading RSS feeds, facebooking or researching that one project is usually not billable]? Usually 10-12 hours depending on if I am on-site or off-site.

4) Working from home rocks and sucks all at the same time - I love working from home but sometimes it sucks. The dogs want attention, your significant other wants attention and then there is always that movie you have been meaning to watch :). Anyway, over all I enjoy it but taking a break and working at a coffee shop for a few hours or grabbing some lunch with a bud is a great way to break up the solitude.

5) Remember to take a break - For awhile I was just busting ass and feeling like I was never getting stuff done. I think taking a break to read a book, watch some TV, hang with humans, etc.. Whatever it is, is just a wise idea or else you get burnt out way too quickly. I mean really does that project need to get done right now? I highly doubt it, even if the client says it needs to most of them won't notice an hour difference from my experience.

6) People won't be immediately pounding on your door - It took about three weeks for me to get fully booked. Granted this was with business relationships already started and people knowing I was going on my own. I could only imagine that it would take a lot longer if business relationships had to be formed, etc...

I am sure I have tons more lessons learned but those are the ones I can think of and I need to get back to work :). Going on my own has been great but it isn't easy that is for sure. As I have said to people before I traded a job working from 7Am-4PM and having weekends off to working from 7AMish to 10PM with no time-off. The trade-off though is I get to help a lot more companies and learn a lot more which is what I enjoy.

Well off to refill my coffee cup and start slinging some code!

Creating a Splash Page in WordPress

2009-08-13T21:13:00.001-07:00

Earlier this week one of my clients asked me for help on creating a splash page for a blog they where setting up. I of course said sure and figured it would only take like 2 minutes. Sadly, that wasn't the case there where a few issues that we ran into:
1) The way the blog was setup the urls looked like /?cat=16 instead of url-friendly
2) There was no way to specify a default blog page
3) The client didn't want to move the blog to a sub-folder (understandably)

The first solution I had was to set the default page but without modifying WordPress itself some of the links would just return you to the splash page. After a bit of messing around with .htaccess I finally came up with these two lines of code:


RewriteCond %{QUERY_STRING} !.
RewriteRule ^$ /splash.php

Basically what it says is if there is no querystring specified and the url is an empty string go to the splash screen. That is it and it worked!

What do you suck at when you develop code?

2009-08-01T06:21:00.001-07:00

Everyone has a weak spot or a place they suck when doing any task, hence catch-all phrases like "no ones perfect". Since I am a developer I tend to look at development practices in general to see what could be improved or things that constantly happen to other developers. One thing I find interesting is how people cope with the thing they suck at the most. For instance I tend to rush things. Sure I get the code done quickly but usually it comes at the price of not fully testing the code I have written and bringing bugs into the system. If I remind myself to slow down then less bugs show up, shocking I know :). But what about other developers and the issues they have? I have seen all sorts of things like:
- Not seeing the forest from the trees
- Not taking the time to think of code maintenance down the road
- Not caring about usability

So, how have different people coped with the issues? I feel there are a few different ways you can cope with any short-coming you may have they are:
- Use a tool that helps you gain strength in a given weakness
- Find a buddy that is strong in your weak area
- Avoid the area like the plague
- Ignore that you have a weakness and think you are perfect :)
- Try to improve in that area

Use a tool that helps you gain strength in a given weakness:
This is a pretty good way to solve the problem if a tool actually exists and it works with your workflow. It is pretty rare to find such a tool for your given problem though but since we are a developers you can always just write a tool. For example if you tend to create lower quality code that is sloppy using a tool like FxCop could help increase your overall quality.

Find a buddy that is strong in your weak area:
What we can't just do stuff in a vacuum? Having this as a solution rocks but can also be difficult since you have to find someone that also meshes with your personality and has the time and want to help you. Hopefully their weakness is your strength so both of you can tradeoff in helping each other out. I have seen this work before but it seems fairly rare. Also, besides finding a buddy you can always hire someone to cover your weakness. For instance in my case it would be possible to hire a software tester to find issues on my code to minimize bugs that get sent to clients.

Avoid the area like the plague:
This is one of the simplest way to fix an issue you suck at. But it is also not always possible or it could be very self-limiting. For example if you create very poor UIs then maybe hand that off to the weird design dude that loves his mac and prefers doppios over that tall skinny soy latte.

Ignore that you have a weakness and think you are perfect:
This is like buying a mirror to make you look slim when you weigh 600+ pounds. Sure it makes you feel better but it can be annoying and disastrous. Sadly this seems to happen with a lot of people.

Try to improve in the area you suck at:
I personally believe this is the best solution but it is also the toughest. Trying to fix the issue you might have will take awhile and you have to remember to get back on the horse when you fall off. Some things I have read and done to fix pitfalls is by reading about the topic, consciously remembering the issue and catching yourself when you get into your old ways and having someone there remind you when you mess up.

I am sure there are other ways to fix being sucky at certain things so if you have a few ideas feel free to chime in :).

Refactoring - Sometimes it gets messy before it gets clean

2009-07-14T20:05:00.001-07:00

Recently I tweeted.

About to put my refactoring skillz to the test. The challenge a 27,000+ line "class" for a delphi CGI.

I am still working on this little side project and it has been pretty fun so far. One thing for sure is that just like many cleaning projects it always seems like it gets a bit dirtier as you throw stuff around before the project gets cleaner. Right now if I just checked in my code it would be bad, very bad. The code is brittle at best and the coupling between modules is so high it might reach into space. But hey it is just a first step and what does this first step look like?

It follows the general advice to look for similar functions and put them in their own code files. Note I did not say class. Since I have so much code to wade through I did not want to figure out on my first step all of the places I had to instantiate a new object and call it, plus I would have probably gotten the class wrongly designed in the first place. So, I mainly just referenced the different code files in the main class and made them static methods for the time being. Some of the code files turned into what would be expected like file utilities (deleting temporary files, writing to common locations, etc..), HTML utility methods, etc... I am not a huge fan of utility "classes" but wading through 800 lines of utility code and figuring out a design for common items is tons easier than wading through the gigantic mud-ball that currently exists.

Once I moved a few of these general functions around I started on something that would make a bigger impact and would be a little tougher. You have to understand one thing about Delphi is that it is a RAD language I don't mean it is cool I mean it is a Rapid Application Development language, what does that really mean? It means it turns into a huge event-driven mess that makes grown men cry when a button event, updates a field, which fires an update event, which updates a field which updates some dataset which then fires another event, you get the idea. All of these reports had events tied to them which meant a lot of code to move and a lot of interdependencies that would be "fun" to move, but hey I was up the challenge :). I did what any sane code-junky would do I copied the report objects into a new class and then leaned on the compiler like I had just finished a fifth of vodka on my own. To get the code to compile and be functional I had to pass in a reference to the monster class. This means there was now a recursive dependency between the two which is not prime but like said earlier it is a start and this was one of the messy parts of the code. To give you an idea on the interdependencies I tried to pass in the needed parameters for a method but I gave up after the parameter list grew to 15! Once I got this area to compile I then did some quick functional testing to make sure the program was you know still usable.

At this point I had shuffled around 4,000+ lines of code and things where looking slightly better and there was at least a glimmer of hope. What are my future steps? I plan to continue to look at the methods in the monster class and bucket them out to code files. After that I will start to move them into classes, implementing interfaces and hopefully writing some tests. I will write about my progress at each step of the way. If there are any questions on how I am doing something or advice from other people who have tackled similar monster classes that would be awesome.

Good times ahead

2009-06-28T20:59:00.001-07:00

As many/all people who read this blog know I have been doing freelance work on the side for the past five years. Many of those years I would say stupid shit like "once it gets a little bit busier I will go on my own." Realizing that is a bit like saying "once I get XXX amount of money I will be fine" (which is never true, btw) I worked out a middle ground with my lovely fiancee and am going on my own as a freelance developer/hacker starting on Wednesday. It is pretty exciting and scary all at the same time.

What does this mean for whoever reads this blog? Not too much. I will still post here but I am also going to be creating a company blog in the next few weeks. I am not sure if I will cross-post or what but I would expect that this blog will have a bit more of a personal flavor to it. Well wish me luck because I will need it! :)

Do you care what you are doing?

2009-05-28T21:08:00.001-07:00

I have had this exact phrase being bounced around in my head for the last month or so. As I am out in the working world more it seems that the people who go farther and have a better attitude have one similar thing in common. That thing in common is caring about the work they are doing. Sure, they might not exactly like the task they are currently doing but over all they care about the overall goal of their work. It is very easy to just get a job and not move it forward and complain about how it is and not improve anything. It is another thing to try and push it forward or bring some positive influence into what you are doing. I know people who even think the profession they are in is B.S. but they want to change the field. Sure it might take them 10+ years but even moving one little step closer will keep them energized. I get this way at my day job, the development environment sucks and I will have my bad days where I am cynical but the majority of days I try and remember to improve it in some little way. I don't even think technical skills are as important as actually caring in a field, however, I have a hunch anyone who cares is not lacking in the technical area as well.

I am not saying everyone has to care about their job I am just saying this seems to be what I have noticed for the people who draw people together, seem to create the "cool" things and are known as being very good. Maybe this is what some people use the term "passion" for but I feel they are different. Passion to me seems more like someone who won't give up on an idea and that is the only thing they are focused on and will talk about it all of the time. Whereas caring just means you want to improve a specific thing and don't want to see it get any worse.

Well, it is just a thought that I have had for a bit it might be crap or it might be good, I am sure it isn't original but I figure I would write about it any ways :). Time for another coffee!

TED Talk - Why we should play

2009-03-18T22:31:00.001-07:00

If you are stuck up or just need an excuse to play around watch this video:

Maybe I should show this video to my boss when he looks at me funny for doing cart wheels or skipping down the hall. But it is sure fun :). I know you can't play / goof off all of the time but I find that people are way too damn serious all the time. It is like most people think they should be conservative and not goof off once they leave high school and/or college give me a break. Especially in this day and age we should all laugh at stuff and goof off. Ok enough of my personal philosophy :).

Back to work..

Cult of Done Manifesto

2009-03-08T22:36:00.001-07:00

This is just awesome...

http://www.brepettis.com/blog/2009/3/3/the-cult-of-done-manifesto.html

Article on Solitude

2009-02-01T16:39:00.001-08:00

I just finished reading this article on solitude. I found it gave me something to chew on for a bit. I am still trying to figure out if I completely agree with his ideas or not. I can understand where he makes his conclusions from. Well if you have a few minutes it might be worth the read.

Funny TED Video

2008-12-19T06:38:00.000-08:00

My Dad introduced me to TED and I have been watching the videos off and on, many are great and a few just stick with me. Like the one below:

It is only 9 minutes and will at least make you crack a smile.

Twitter + Me == Hour suckage

2008-09-07T13:13:00.000-07:00

In case any of the few people who read my site wish to follow me on twitter go for it. My twitter url is http://twitter.com/noskillz not sure how long I will keep doing it. It is not like I have enough distractions to keep me from doing meaningful work :).

And I am out...

2008-09-06T23:03:00.001-07:00

Most people that know me, know that my last day at Microsoft was this past Friday (9/5/08). Why? Well there are many reasons some I might write about others I probably won't :). Anyways, I am going back to my past employer TransGroup where I will once again be joining the development team to kick ass, take names and try not to hose their live systems. Will I still be doing security, hell yea, shit I might even get more done. Working at Microsoft was an interesting experience and I met some cool people. I didn't learn much sadly though. Was it a wasted opportunity? Probably. Could I have done better? Yea. Could I have done worse? Yea.

I will miss a few things though:

The coffee machines (best work coffee I have had yet)
Bluehat
Access to all of MS's software
Some of the people I worked with (but then again I will probably keep in touch with them)

Things I won't miss:

The slowness & process
The crappy paycheck and monetary rewards
The political environment
The slowness (did I already mention that?? :P)

Many might wonder why I didn't go be a developer at Microsoft. Could I have cut it there? From what I saw the answer would be "of course :)". However, since I was brought in at a low level I would have stayed there even if I switched to being a developer, now I maybe be a little slow in the head but I am not that idiotic. I don't want to go through years of being under-paid to maybe some year make up for it (and that would be doubtful). Plus, the way software was created isn't how I want to work. I finally came to the conclusion that the only way for me to write software the way I want is to go my own way. While I work on that, I plan on keeping a paycheck though, so, you know, I can like pay my bills :P. Who knows maybe I can do both and make lots of money, only time will tell. I like the environment at TransGroup but I also know that my true dream is to run my own business and work for myself and my clients.

On that note, I am off to go work on some projects (more about that later).

But what would I have to offer?

2008-09-02T10:33:00.000-07:00

This weekend I said to a guy I know that he should start moonlighting. Why? Because he complains about not having money and/or he says he could never beat the amount of money I make. Of course I think that is utter bullshit, but, I recognize this as more of a self-defeating attitude. But I was musing on the excuse given which is the title of this post "but what would I have to offer," that has more ramifications than I expect most people to realize. The simplest one is this, if you have no idea how people on a free market would use your services, why would an employer hire you? Anyone can be a grunt, so what sets you apart? My guess is that these same people also have a hard time getting a job or always feel they couldn't get a specific job. Because really even if we are a wage-slave we are just internal consultants to all of the other employees. We need to provide some type of value that few people can deliver. Sure, that takes a little bit to figure out (shit I am still figuring it out) but it is something to keep in mind.

An Improvement on Output Encoding in .Net

2008-08-28T22:20:00.000-07:00

Most people I talk within the application security community usually hear me say that the frameworks are not great in preventing common vulnerabilities like XSS. Well as I am changing jobs and I want to brush up on some C# concepts I decided to put my coding skills where my big fat mouth is. I sat down for 30 minutes and wrote a prototype and I will continue working on this throughout the week to get more familiar with the framework.

Just to prove that I am not just talking up a storm here is the initial code.


public static class SaferEncoding
{
   public static void SaferText(this System.Web.UI.WebControls.Label lbl, System.String s)
   {
       lbl.Text = AntiXss.HtmlEncode(s);
   }
}

Some might notice that I am using AntiXss for the encoding. The reason? Because I know encoding has many nuances so why not have someone else use it. Also, why didn't I override the Text property for the label? Well, there are two reasons:

I wanted it easy for people to find out where they were not properly encoding. For example a security auditor could come in and do a search on ".Text" and if any appeared they would need to have a good reason to use that property.
Sometimes an un-encoded value needs to be used and I understand this.

I will post the updates as they come along, along with the code and binaries. Maybe someone will find this useful.

Funny Amazon Recommendation

2008-08-13T22:13:00.000-07:00

I was sent this today by Heather Burgess (who would I link to if she got her blog up and running :P). I thought it was a great example of when software goes bad, very very bad/naughty.

Well if that doesn't make you smirk at least, you might want to check your pulse.

P.S. Dang two posts in a day a new PR

Tact filter geeks/nerds vs. "normal" people

2008-08-13T08:58:00.000-07:00

I saw this today. I think it is true (obviously there are exceptions) but it makes sense to me. Well read on maybe it will help others when dealing with the other group (e.g. geeks talking to non-geeks and vice versa).

A friendly reminder....

2008-08-05T17:16:00.000-07:00

You are always only limited by your time. Everything else stems from that. Remember this next time you decide to watch TV and then complain about something in your life.

Idleness / busyness article

2008-06-19T20:56:00.000-07:00

I read this good blog post on slow leadership titled "The Bustle of Idleness". I can think of a few people who this applies to, including me. Well go read and have something to think about over your coffee :).

OSX Leopard in a Virtual Machine

2008-06-13T06:30:00.000-07:00

Well, this morning started out good. For the longest time I have wanted to have OS X running in its own Virtual Machine (VM), so I can do some security testing without hosing my main box and because I don't have enough spare money to buy a kick around Mac. I started to research it earlier this week and found out that since the last time I looked into it someone has created a VMWare image of OS X, sweet!

After a few days of downloading (36 different rar files on a file share site, blah!), I have it running and here is a screen cap to prove it :).

Pretty cool, eh? Maybe it is the just the geek in me or the caffeine slowly seeping into my body but I am just f'ing happy right now.

The link I found this information at is http://pcwizcomputer.com/index.php?option=com_content&task=view&id=76&Itemid=48
(bonus points if you can tell me the CMS they are running just by looking at the URL :P).

Also, since it is 36 separate files to d/l this, if you want you can email me and I will post up one large archive for you to d/l off of my server.

So, what am I going to do with this? There are many different things I can/want to do. I think the first thing on my plate will be to fuzz the shit out of Safari and see what crashes and potential exploits can be found. I have had a client have a web page that crashes Safari so I am sure there is tons more I just don't think many people are looking yet :P.

Frameworks for SaaS

2008-06-09T10:18:00.000-07:00

I am seeing a new business emerge which I think is kind of cool. Basically it is frameworks/providers for building Software-As-A-Service applications. I have been a fan of SaaS before it was called that, so, it is cool to see it get some hype.

Two examples of these frameworks are:

SaaS Rails Kit

Bungee Labs (Provider-As-A-Service)

Both of these are very interesting ideas and I think we will see many developers and business people take advantage of this. Although I am a bit worried about SaaS becoming way too over-hyped but that is another blog post all on its own.

What does this mean for the future? I see two things happening.

1) There is going to be more and more SaaS applications built, which will be great for cost. Harder to differentiate yourself (think of blogs right now).

2) There is some good money in getting into this framework niche now.

Well back to work....

OSX == coffee house fun

2008-06-04T22:09:00.000-07:00

I am sitting at my favorite coffee shop working while my girlfriend studies and every time I come here I see all of these macs showing up in my finder. Since I am not in that big of a mood to work I figured I would blog about this as it cracks me up every time. Here is what I see from iTunes and Finder (OSX's version of Windows Explorer).

Look at all of those computers! Most of them I can't read from (well without some work) but most of them I can write too, that isn't too big of a problem is it :P? I mean if I was a real dick I could just pump porn onto their hard drives or... I can steal their music, etc... This reminds me of the late 90s early 2000s with Windows 98 and the XP where sharing was on by default and you could get all sorts of goodies from people's machines.

Alright, back to work, but next time you are in a coffee house and have a mac see how many other computers pop-up in your Finder :).

We only have one shot...

2008-05-12T18:12:00.000-07:00

For the past 1 year and 2.5 months I have worked for a large company and it has been a trying experience for me. Of the many things that I get annoyed with one tops the charts. It is the "we only have one shot" type of mentatilty. I don't mean that there is only one shot and the company will go broke rather we can only ask people to do something that is intensive one time or we only get a six or three month cycle for software and if isn't good then it isn't going to be good but it will be released. Well I don't know about you but I rarely never get anything semi-complex correct the first time. Either I work for unrealistic people, unrealistic management, super-stars, my IQ is deficient or ???. Why can't large companies overall use a process like sprints. Sure people could say it randomizes them, but you know what? Getting an email every 2-5 minutes randomizes you too but people love that because it makes them feel important. I know some groups do sprints and it works well for them. I also realize it is hard to manage large teams (anything over 12) but there has to be a balancing act that gets fast iterations and still get the main goal done.

Password Stupidity

2008-05-01T21:58:00.000-07:00

I was setting up a WordPress install for a client part of which was setting up a new database. I go into their crappy ass management tool and setup the database, as usual I put in some non-alphanumeric characters for part of the password and I get the following message:

Your password can not contain any of the following characters: question mark, space, caret, single quote, double quote, colon, backslash, dollar sign, ampersand, greater than, less than, tilde, semi-colon, accent.

All I can say is WTF! If that doesn't smell like there is come crappy code I don't know what does. Let alone that it lowers the security of the password, argh! It is like putting a maximum limit of 15 characters for a password, give me a break! At least put in upper limit at something most people wouldn't use like say 100 :). Well before I really get on my soapbox I better get back to working on client stuff.