Founder's Blog - Jitbit

Please welcome - HeatTest.com

noreply@blogger.com (Alex) — Fri, 11 May 2012 22:47:00 +0000

We're proud to announce our latest product - heattest.com - a heat-map click analytics for websites.

Finally, a product for startups. Dream comes true. We scratched our own itch and built the service for our own websites and projects.

I know what you're thinking. Yes, it is very similar to "CrazyEgg" and "ClickDensity", but our service updates in realtime. Your heatmaps are not being generated every 24 hours or every hour, but every time you will be looking at your stats. You see the updated heatmap statistics just seconds after someone clicks something on your website.

And unlike Google Analytics that only shows which links people click (messing it all up when multiple links on a page point to the same URL) our heatmap analytics tracks the exact element and coordinates your visitors click. Even if it's not a link or a button.

Another great feature that puts us ahead of the competition is that our script is immune to website layouts, screen resolutions and works out-of-the-box. You don't have to tune it according to your website design ("liquid 100% width" or "fixed-center") or tell it where your logo-image is fixated. We developed a unique architecture that is totally immune to this. Just paste our script and forget about it.

Anyways, I'd be honored if you try it out. Here's the invite code for blog readers: IUWEYR7

Once there was a search engine

noreply@blogger.com (Alex) — Mon, 02 Apr 2012 20:16:00 +0000

This is a sad story of an Internet giant. Started by two guys in a garage it eventually grew to control over 80% of the Internet search market and practically owned the whole Internet.

It was innovative and agile. The stock market loved it - at times the company stock doubled in price within just a month. It was one of the very few surviving companies after the dot-com bubble burst.

The company was adding more and more awesome free services: from newsgroups to image-hosting. It practically reinvented email by launching a great free web-based email app. It introduced a blogging platform and even tried entering the social networking space. It launched a free website-hosting service, introduced its own instant-messenger/voice application, social bookmarking service and many others. It published lots of open-source frameworks, tools and APIs for developers.

The apps it didn't create in-house - it acquired from the competitors, continuing to expand its range of services.

The company acquired several marketing agencies and started offering "paid inclusion" - adding ADs to the search results. Some people even claim that the term "PPC" was invented inside this very company.

But the company kept adding more confusing menus, bells and whistles to its homepage.

The search results were getting more and more cluttered by more and more ADs.

New players came to the field. And many users - first the early adopters then the rest of the crowd - chose the newcomers over the giant.

Eventually, the giant collapsed.

The giant's name was "Yahoo".

"History does not repeat itself, but it does rhyme" - Mark Twain.

Automating Amazon S3 backups on a Windows Server

noreply@blogger.com (Alex) — Sun, 18 Mar 2012 13:58:00 +0000

Our helpdesk app (the hosted version) is being used in about 170 companies. Users have uploaded almost 150k (150,000) files. We have logged about half a million tickets. From about 100k users.

Obviously, we need to backup all this data. And obviously, a consumer product like Dropbox or SugarSync is not an option. We needed something fast, reliable & scalable. We needed cloud storage. So we chose Amazon S3 and I decided to write this simple step-by-step guide for anyone interested in automating S3 backups on a Windows server:

1: Create an Amazon AWS account

If you don't already have an AWS account - create it here, it's free. Amazon's "free usage tier" on S3 gives you 5GB free storage from scratch, so after registering, sign in to your "AWS Management Console", select the "S3" tab and create one or more "buckets" on the left.

2: Get your access keys

You will need security credentials to access your online storage from the server, so click your account name - "Security Credentials" - "Access Keys" and copy your Key ID and Secret.

3: Download "S3Sync"

"S3Sync" is a great free command-line application from SprightlySoft. It is .NET-based and even comes with the source codes. At the time of writing this post their website was down, so I published the tool on Google Docs here: S3Sync.zip.

The tool syncs a given folder with your S3 bucket. And the best part - unlike similar scripts and utilities it performs a "smart" differential sync that detects additions, deletions and file-modifications.

4: Write a backup script

Create a batch file and paste this code into it:

S3Sync.exe -AWSAccessKeyId xxxxxxx -AWSSecretAccessKey xxxxxxx -SyncDirection upload -LocalFolderPath "C:\inetpub\wwwroot" -BucketName YOURBUCKETNAME

The code above is pretty self-explanatory. Just replace the "xxxxxx" with your access codes from #2, "YOURBUCKETNAME" with the name of your S3 bucket, and "C:\inetpub\wwwroot" - with the folder you want to backup. Then create a scheduled task that runs the batch file every 24 hours, and you're all set.

5: Pricing

Amazon gives you a 5 GB free storage during the first year. After the year ends the pricing is still very moderate. For instance, a 10GB storage will cost you about 60 cents a month which makes it a no-brainer.

Wait, don't add that feature

noreply@blogger.com (Alex) — Wed, 14 Mar 2012 17:28:00 +0000

Just had an argument with my partner. He was going to add a new logging feature to our help desk app. Another feature. Another button in the admin panel. Another setting. Another report to read.

This reminded me of Jamie Zawinski's law. The one that says every program attempts to expand until it can read mail.

Looks familiar?

Stop adding frigging features. If you think there's a killer-feature worth adding... think again.

If you're still positive about it - make sure that:

...the feature works exactly like it's supposed to.
...the feature works like the users expect it to which is even more important. If the user expects a fireman to resque his cat - give him a shiny "fireman" button, not a "cat rescue squad".

That's why Adobe Photoshop has so many photography terms in the user interface. The majority of Adobe users are photographers, who expect these names. They want menu items to say "aperture" and "exposure", instead of "blur the background" and "clip the whites".
...the feature is easy to locate. Add features, not easter-eggs. It won't add any value to your product if no user can find it. And adding a gigantic manual called "keyboard shortcuts and other hacks" is also not an option. The hacks, shortcuts and gestures should be obvious.
Don't make assumptions. Ask your users before adding a feature. Measure if the area of your app you're willing to improve is even being used by anyone. And that "genius" feature of yours might actually turn out to be a piece of crap. Lots and lots of startup founders I know keep avoiding this step.

PS. Image courtesy of Erik Burke from "stuffthatmatters.com", his site seem to be down, fortunately, had it saved on my HDD.

Why Developers Hate Antiviruses

noreply@blogger.com (Alex) — Wed, 25 Jan 2012 18:13:00 +0000

I hate antivirus software. I really do. Like almost every desktop software developer.

And the reasons are:

#1 - False-positive alarms

I'm sick and tired that my software is being detected as a "virus"...

...in spite of being signed with a trusted Verisign certificate.
...in spite of being .NET-based (a platform which is not very "virus-authoring-friendly", so to speak) and not even using any code-obfuscation.
...in spite of using the "ClickOnce" installation-technology (in other words - the code runs in a sandbox).
etc.

Why?

Because if your software has some kind of copy-protection built-in (encrypts and stores serial numbers, hides parts of the source code to protect from reverse engineering etc.) - an antivirus will most likely detect some "very dangerous" trojan.

Because if your software tracks mouse or monitors keyboard (like our AutoText for instance) - an antivirus will detect a malware.

Because if your software is some kind of a "compiler" - i.e. it's capable of building its own EXE-files - an antivirus will detect a self-replicating virus. Oh, and all your EXE-files will also be marked as viruses by the way (since you're most likely using a "self-executing-unpacker-code + data" architecture, which is considered a risk-factor by most antiviruses, no idea why).

Because if your software uses the "ClickOnce" technology (an auto-update framework that comes from Microsoft and is built-in to Windows!) - an antivirus will detect a "trojan downloader" and block your website in some cases.

These are just the few... And these are the actual reports I deal with every week. "Help, AVG blocks your installer saying it's a Trojan!", "Help, Opera has just blocked the downloaded file!".

EVERY. FUCKING. WEEK.

#2 - Antivirus vendors not dealing with false-positive reports properly

Now, dear antivirus companies! I understand - Users come first. Their security is your utmost concern. If someone sends you a virus sample - dealing with it is your #1 priority. I understand. I'm one of your paying users after all.

But please don't forget about us, the developers. We do send samples as well - the "false-positive" samples. We deserve some response. Fine, let it be within a week. Two weeks. A month. Two months. But please react!

Instead, some of you do not even have a feedback form or a forum on your website so we can upload a false-positive... And those who do, sometimes require us to send you our code-signing certificates, home-addresses, company papers and photo-IDs... We're guilty by suspicion. Everything is a virus until the author proves the opposite.

PS. In fairness, though, some antivirus companies do have these feedback forms in place, have nice developer support, and react promptly.

#3 - Antivirus my ass!

Create a simple C program with a code like this:

#include <windows.h>

#include <string>



int __stdcall WinMain(HINSTANCE,HINSTANCE,LPSTR,int)

{

  return MessageBoxA(0,(std::string("->")+GetCommandLineA()+"<-").c_str(),"Cmdline",0);

}

Compile it with a free "express" edition of Visual Studio 2008:
cl -Os -EHs-c- -GR- -MD test.cpp /link -fixed:no user32.lib -incremental:no -out:test.exe

Now test this program with your favorite antivirus. Voila! A "TR/ATRAPS.Gen" has been detected.

Congrats! You've just wrote your first virus!

Our Two Cents on SOPA

noreply@blogger.com (Alex) — Sat, 24 Dec 2011 08:48:00 +0000

Jitbit Software has just transferred all of it's domains away from GoDaddy because of their SOPA bill support.

That's the least I can do. I'm outside the US, so I don't have a congressman to contact. If you are - sending a letter to your congressman is the only way to prevent the bill from being approved.

If you’re not sure what the "Stop Online Piracy Act" is - visit this link and read SOPA For Dummies

Now, there's a question that haunts me these days. Lots of non-tech friends, ex-colleagues, even some fellow hackers keep asking me:

"If you're selling downloadable software online, you're supposed to support SOPA, right?"

1. No, software companies don't benefit from SOPA

I've said this many many times and I'm gonna say it again: if you're a software company - stop worrying about "pirates". Stop throwing piles of money at a complicated top-notch software-protection system. An "ok" system is just fine, just to keep kids from messing around with your licensing system and writing key-generators. But beware of the "unbreakable" systems.

First of all, "pirates" don't pay anyway. These users have already made their decision. They'll keep looking for a way to get your app free of charge. Nag screens and functional limitations will only annoy them.

And if your app is "unbreakable" - they turn to a competitor and you lose a user. In fact, making your app "unbreakable" brings other risks as well - eCommerce fraud, stolen credit cards, chargebacks etc.

So, one or two cracked packages floating around on torrent-websites are just fine. In fact, we have tons of customers who bought our tools after trying the pirated version and loving it.

2. Guess what - SOPA won't even work

SOPA targets HTTP and DNS protocols. Leaving behind the torrent-protocol. Which utilizes neither HTTP or DNS. And which has the 99% of the world pirated traffic. My cracked packages will still be out there somewhere.

Here's what will happen: huge corporations get a new way of suing and shutting down competing websites. Lots of young companies and startups move their websites, servers, domains outside the US to minimise the risk - just like they're moving away from GoDaddy right now (see GoDaddy lost 21k domains in one day). Online businesses switch to European payment-processing gateways. End-users experience longer latency. US hosting companies, data-centers, domain-registrars lose their customers just like GoDaddy loses it right now. Google won't be able to crawl "blocked" websites, moving the crawlers to data-centers overseas (still making "bad" websites appear in its cache). The majority of online sales moves from away from the US to the outside world. Etc.

And guess what the pirates are still there. Outside the HTTP/DNS protocol scope.

[Infographics] The Ultimate Career Advice

noreply@blogger.com (Alex) — Fri, 16 Dec 2011 10:55:00 +0000

I'm SO happy to be in the middle.

And don't forget to check the 24 Steps To Success.

Rethinking the Cloud

noreply@blogger.com (Alex) — Mon, 28 Nov 2011 14:20:00 +0000

For months I've been thinking that a "cloud-server" is just an overpriced version of a VPS.

Don't get me wrong, I get the platform - as a software engineer. As a business owner - I even get all the benefits - elasticity, reliability, scalability, flexibility and all the other "bilities". On the other hand...

See, a regular VPS also runs "virtually" - just like the cloud. It's isolated from the host-machine failures - just like the cloud. The latest VPS-software (say, vSphere) can even do load-balancing, shadowing and real-time switching between physical hosts in case of a hardware failure - just like the cloud.

So, what's the difference then?

Actually with a VPS you might end up paying for unused CPU-cycles, unused hard-disk operations and unused extra RAM. But that's fine with me. As long as it's cheaper.

No cloud for "fat" servers

Let's have a look at one of our virtual servers - it runs a couple of static websites and two huge ASP.NET SaaS-applications along with their databases. It has an 80 gig hard-drive and 4 gigs of memory. Every month it eats up 500 gigs of traffic. And the monthly price is under $100. Now, according to Amazon's Pricing Calculator setting up a similar server in the cloud would cost around $500 a month. Seems expensive?

That's not how you estimate the cloud

Recently, while doing a project for our hosted help desk app, I realized that's not how you estimate the cloud. While VPS'es are fine for heavy & continuous work, the cloud can be great for occasional stuff, when buying a separate server would be ridiculous.

Real-life example: virtual emails for the helpdesk app

We figured we need a new feature for our helpdesk app. We wanted to provide our customers with free temporary email-addresses. And not just random addresses, but the ones that use the same subdomain as the SaaS web-application.

I mean, if "Acme Motorcycles" runs their SaaS-helpdesk at "acme.jitbit.com" I want to give them the "support@acme.jitbit.com" address. So they can start using it right away, without configuring POP3/IMAP interfaces, or any other complicated stuff.

To make this work I needed a "catch-all" email setup that will intercept all emails like *@*.jitbit.com. And the only way I found I could do this (aside from writing lots of code and setting up a weird DNS configuration) was to set up a Linux machine running Postfix agent.

I couldn't use my existing servers cause they're Windows-based. I did not want to rent a $20 linux box just for that... And then I realized that the cloud could be the ideal solution.

I'll save the step-by-step instructions for another post, let me just concentrate on the price here.

It turned out an Amazon server doing this kind of mail routing for us would cost... Around 35 cents a month.

35 cents a month. It even has a 10 GB drive (9.5 GB of which is obviously a free space) and runs 24/7. Which means, if I lower the disk space and set up a script that schedules this server to start/stop every 10 minutes (enough for email routing) it'd be even less. But I won't even bother. Cause - did I mention - Amazon's micro instances stay free for the first year.

I'm a cloud fanboy now.

Trying Rails & Mac, confessions of a .NET developer

noreply@blogger.com (Alex) — Sat, 12 Nov 2011 19:08:00 +0000

I run Windows on my MacBook.

Windows - because I'm a .NET developer and our startup is mainly Microsoft-based. And, to be honest, I like Windows 7. Finally, a decent OS from Microsoft.

And MacBook - because it's simply the best hardware you can get for it. The unibody design is awesome, the keyboard & touchpad are great, the 17" screen is fabulous... I love my Mac. I'm practically an Apple fanboy.

The only thing I don't like about my Mac - is Mac OS X.

It just didn't suit me from the very beginning. That blurry font-rendering, that mouse acceleration you can't disable... Also, I'm a gaming junkie and, let's say, Mac is not the most popular gaming platform.

But let's try a Mac for a change

Yesterday we had a new project idea and my cofounder suggested we do it on Rails. I was pretty open-minded about this. After all, it's always nice to try new languages, frameworks and environments, right?

And, hey, all the cool startup guys do their startups on Macs! There must be a reason, right? I want to be like that 37Signalish/YCombinatorish startup crowd. I want to be like those cool kids doing trendy Web 2.0 apps on their Macs. I don't want to be "a PC" from the Apple commercials. I want to be the "skinny-hipster-Mac". So let's develop in Ruby. Hell yeah!

Also, Macs should be easy to use, right? Everything works "out of the box", right? I mean, my Mac came from Apple. Same company that made my iPhone. And my iPad. And my iPod. And my other iPod (gee I really am an Apple fanboy). Also, I'm kinda familiar with *nix operating systems, the Bash command processor and stuff... So, there should be no problem right?

"Totally", - that was Max, my cofounder, - "no problem. Works right out of the freaking box"

The long journey

"Out of the box" turned into 40 hours of installing, reinstalling and configuring stuff. I'm not judging, just describing the steps I had to take to prepare my Mac to write some Rails code. Maybe it's because I'm just a dumb Windows guy.

First I figured that I need, well, Rails installed. Along with a Mercurial client. That should be enough to get me started and shouldn't take more than an hour to install.

While trying to install both Rails and Mercurial I got a bunch of error messages about an outdated Python version I had on my Mac. Fine, let's get a fresh version from Python.org... Didn't work. The "Pyhton.prg" version installs side-by-side with the built-in "Apple Python" and Mac OS still thinks I have an old version... After some head-scratching I decided to let my Mac check for updates - and bingo, Python was updated. But still, the version was not good enough for Rails & Mercurial... After another hour of black magic with python & homebrew and forcing another software update the Mercurial client was finally up & working.

But not Rails. It turned out it requires the "ruby-dev" package installed. And, well, the only way to get "ruby-dev" I found - is to install XCode. The big, heavyweight development suit from Apple.

Fine.

I tried downloading version 4.0 but the Apple website gave me an error in Chrome. I tried opening it in Safari, and it asked me to regster as an Apple developer.

Fine.

Let's get a developer ID. I filled out a lengthy form, confirmed my email address, got myself a developer ID, and... the Apple website showed me the exact same error message I got from Chrome earlier.

OK, there is another way to install XCode - to get it from the AppStore. But you need a Mac OS 10.7 Lion for that. Which is another hour of downloading, another hour installing and another $30 to Apple, because Lion is a paid sucka... OK, I'm on it. Gimme that Lion.

Another couple of hours downloading XCode 4.2, installing it, configuring all the "gems", and finally, after 40 hours of having sex with my Mac I was finally able to open "localhost:3000" and start writing some code.

Same on Windows

During that weekend I had to reboot to Windows a couple of times to fix some minor bugs in our helpdesk app and do some support stuff... And at some point, while in Windows, I had to make an urgent fix in our Rails app. I was too lazy to reboot back to Mac OS. So I decided to fix that on Windows.

I went to RailsInstaller.org, installed Rails, "pulled" the app from the repo, made the change, tested it on "localhost:3000", and pushed my changes back to the repo. And all that - in 9 minutes.

Wow.

9 minutes. Including the coding part. And including the time I spent Googling for tips & best practices on setting up Notepad++ for Rails development.

Sorry, folks. Call me a pervert, but I'm doing Rails development on Windows now.

I know!

I know that it's just me being dumb and, maybe, too used to Windows-ish ways of doing things. I know my Mac software was outdated. I know that every Mac developer probably already has XCode installed. I know I was having problems with the Unix-part of my Mac, not the shiny part of Mac OS. I know that in Windows it also takes time to install Visual Studio, SQL Server and other stuff to get you started (none of this is required for Rails though), I know comparing setup times on a platform you work with daily to a platform you've never used before is a bit unfair.

Some day I will make another attempt to move to the Light Side of the Force. Who knows, maybe even learn Vim! But we have a project to get done, so... Maybe next weekend.

Boosting Creativity Tip #1

noreply@blogger.com (Alex) — Mon, 31 Oct 2011 14:38:00 +0000

"Ideas don't come from watching television" Seth Godin.

Stop watching. Start reading books.

When you read a book, your brain is in the "uber-creative" mode. It analyses the text and tries to visualize what you read. It builds abstractions, pictures, sometimes even a whole new universe... Every time your read something - your brain is working out in gym.

On the contrary, when you watch - everything is pre-created for you. You just sit there and consume the picture. Your brain rests. Everything is pre-constructed.

And just like your body passes through different sleep-phases before it goes to the REM sleeping phase, your brain passes through different creativity phases before it reaches the "uber-creativity" peak. This means, the reading process should last, uninterrupted, 10 minutes least. So we're talking fiction books, not Twitter, not blogs or news feeds. Not even professional literature. Fiction books. Biographies. Semi-fiction books, like Steve Jobs story or Anything You Want by Derek Sivers (highly recommended, by the way).

All the coolest ideas I had - I had while reading a book or listening to a great talk. So here are some tips for reading more:

Take reading to where you have to wait - in the lines, at the landromat. Use public transportation - buses and the tube - instead of a car.
Use gadgets. Use your smartphone. Buy an electronic reader and take it wherever you go. Since I bought my first Kindle, I read much more. Much more. Though now I prefer Sony over Kindle.
Always have something to read. And contrary to common belief - it's great to read several books at a time. It's working out, remember?
Use audiobooks when jogging, biking or cooking
Read less. Read books you enjoy. If the book doesn't feel "right" after the first chapter - move on, don't force yourself. Don't feel pressured to read a book just because someone gave it to you as a present. Or you got it free at some conference. Stop. Move on. Otherwise only a half of your brain will be actually reading, the other half will be busy fixing your attention.

Outgoing Links Effect for SEO: Experiment

noreply@blogger.com (Alex) — Fri, 26 Aug 2011 08:37:00 +0000

There's been a lot of debate about whether external linking helps or hurts your SEO and most of the SEO experts including the gurus at SEOmoz tend to think of external-linking as a good strategy.

I made a simple experiment about six months ago. And discovered the flip-side of the coin. Here are the exact steps I took:

I have a page that ranks on top of Google's SERP. It's our Macro Recorder homepage. I've put a lot of effort to get it there and it took us five (5) years of hard "white-hat" work to rank high on "macro recorder", "mouse recorder", "macro program", "keyboard macro" and all the variations.
I've put an external link on that page - linking to a Wikipedia-article on the very same topic - "macro recording". It's a highly relevant link, obviously. And what can be more trusted and authoritative than Wikipedia?.
Boom. In one day the Wikipedia article has outranked my page in the SERP.

Enough said.

So be careful.

I guess in my particular case the reason was as follows: domains like Wikipedia are much, much more "trusted" and "relevant" in Google's eyes, that's why adding one tiny link to it's macro-recording article rocket-launched the article outranking my own page.

Removing the link restored rankings back to normal. But it took several days.

Go Get A Cofounder [Mistakes I Made #5]

noreply@blogger.com (Alex) — Wed, 03 Aug 2011 14:46:00 +0000

This is the 5th post in the "Mistakes I made" series, where I share the "donts" of my startup experience.

I'll start from afar. My website has a number of pricing tables and I thought the tables look just fine. Until one morning I realized that they're a complete usability nightmare. Here's the "before" look:

A messy pile of text, prices, red-fonts and buttons organized into variable-height rows. I spent an hour or two tuning it until I had a much cleaner design:

A small number of tiny changes - making the price "stand out", adding background colors to the table rows etc - has improved my conversions by almost 10% and sure saved me from a number of support-questions... But I had a crappy pricing page for years. All because I didn't have a cofounder to tell me to "go and redesign this crap".

You need someone to call you an idiot

There are downsides of being a single founder. Even aside from the fact that a startup is too much for one person to bear. You need someone to challenge you. Someone to question your decisions.

Someone to call you an idiot. To tell you "man, this is crap, and needs rethinking".

Employees won't call you an idiot. You're the boss. Even if they try, they fall back as soon as they face resistance - "ah, whatever, you're the boss, it's your call". In fact, most of the failed startups I know have this in common: the lack of someone calling the founder an idiot. That eventually makes him come to believe that he's always right.

Customers won't call you an idiot as well. The ones that would - have already chosen your competitor's product. Also, as we all know from Joel:

Customers Don't Know What They Want.
Stop Expecting Customers to Know What They Want.

As a single person in charge you get used to your creations (that you're obviously in love with), not noticing the obvious idiocies. At that point getting a cofounder becomes more important than anything else. So go and get one now.

PS. I highly recommend reading PG's essay on this (scroll to #6).

"90% of your users are idiots"

noreply@blogger.com (Alex) — Mon, 27 Jun 2011 14:12:00 +0000

I just overheard this conversation between two developers at a co-working site:

"I plan creating a prototype for my new XXXX application, whatcha think it should be - a web-app, or a desktop app?"

The answer was:

"90% of your users are idiots who won't be able to tell the difference"

I think I just found my answer to the ultimate question of life universe and everything and it's not "42".

It's "90% of your users are idiots".

Now thats a questionable term to describe your customers. I don't think 90% of my users are idiots. But. That's the way to think of your users when making design decisions and building your interface.

Wondering if you should make this main button big or small?
"90% of your users are idiots"
Wondering if it should be one button or two?
"90% of your users are idiots"
Wondering if your installer should ask all those really important questions, like, how it should name the installation folder under "Program Files"? Or just perform the default action with no questions at all?
"90% of your users are idiots"
You're absolutely sure that the "pricing" page of your website should have fifteen different "plans" of your SaaS application?
"90% of your users are idiots"
Wondering if you should publish the installer as a ZIP-file or as an EXE-file?
"90% of your users are idiots"

And, in good conscience, don't you want to be an idiot when you're on the other side of the screen? I do! I want to be an idiot!

Please let me be an idiot. I want things to "just work". Don't make me figure my way through all the setup procedures. "Don't make me think" (c) Steve Krug.

I've been a computer nerd since I'm 11. I mean, I love the command line and stuff... But when I urgently need a port-scanner to test my server vulnerabilities after it's been hacked, I don't want the nmap tool, with a dozen of command-line options and a bunch of drivers it requires me to install. I just want a big red "scan" button. I'm an idiot, OK?

What If Drivers Were Hired Like Programmers?

noreply@blogger.com (Alex) — Sun, 22 May 2011 10:22:00 +0000

What if drivers were hired like software developers?

Job title: car driver

Job requirements: professional skills in driving normal- and heavy-freight cars, buses and trucks, trolley buses, trams, subways, tractors, shovel diggers, contemporary light and heavy tanks currently in use by NATO countries.

Skills in rally and extreme driving are obligatory!
Formula-1 driving experience is a plus.

Knowledge and experience in repairing of piston and rotor/Wankel engines, automatic and manual transmissions, ignition systems, board computer, ABS, ABD, GPS and car-audio systems by world-known manufacturers - obligatory!

Experience with car-painting and tinsmith tasks is a plus.

The applicants must have certificates by BMW, General Motors and Bosch, but not older than two years.

Compensation: $15-$20/hour, depends on the interview result.

Education requirements: Bachelor's Degree of Engineering.

Saw this on a programmer's forum, but was unable to locate the original. Let me know, I'd be happy to link.

Rootkit on a brand new Toshiba Laptop

noreply@blogger.com (Alex) — Sat, 30 Apr 2011 12:02:00 +0000

Sorry for the offtopic, this post has nothing to do with startups, web-development or entrepreneurship, but I felt I should still write this

I've just discovered a built-in rootkit in my wife's brand new Toshiba laptop. A non-removable malicious software application right from the manufacturer. That even captured and sent-out screenshots of my wife's work... But first things first.

First, let me apologize for the tone of this post and kinda incoherent writing. Please try to imagine where I am right now and please accept my apologies - I just finished dealing with this issue, like, 10 minutes ago. And, to be honest, I'm angry as a bear.

It all started with some corrupted files & folders on my wife's laptop. No problem - I launched the "CHKDSK" utility and scheduled a disk scan on restart. No big deal, right?

Except - there was no disk scan when I rebooted. I tried again - no scan. I tried everything: rebooting to safe-mode, marking the disk as a "dirty" one with the "CHKNTFS" tool, booting with recovery disk - nothing helped. I just couldn't launch checkdisk or schedule it for the next startup. So, I figured that the checkdisk file itself might be corrupted, so I ran "SFC /scannow" command that, supposedly, should restore it.

The command went up to 47% and aborted with the error message "Windows Resource Protection could not perform the requested operation". Hmmm... May be there's a virus preventing this? So I opened the Process Explorer tool (God bless SysInternals) and found a suspicious process called "rcpnetp.exe".

Why hello there! The process has no "Description" and "Company Name" fields, it loads "rcpnetp.dll" via AUTOCHK.EXE. A-ha! The tool that is supposed to launch startup disk scan! This can't be a coincidence. I opened Autoruns (God bless SysInternals #2) trying to find some registry key or something that launched this "rcpnetp" process.

Surprisingly, I found nothing. I decided to kill the process, delete those files from the "System32" folder and reboot the laptop. Imagine my frustration when those processes were back there, up and running!

I spent hours trying to figure, where this monster launches from... I tried several antiviruses, manual registry search, SysInternals tools... Nothing. So I turned to Google. And found some links (the second link is in Russian).

It turns out the files are loaded from BIOS:

It's a "security" software built into the BIOS of many laptops called CompuTrace. It is sorta like "LoJack" for laptops. If your laptop is stolen, CompuTrace can notify a server where your laptop is. It is written by Absolute Software and provided to laptop manufacturers so they can include it in the BIOSes they supply for their laptops.

CompuTrace is a rootkit <...> it will hijack the AUTOCHK.EXE process that normally runs during Windows boot, and instead run its own code. One issue this rootkit may cause: chkdsk will not run during boot like it is supposed to.

So, what is this thing?

I'll summarize what I've found out so far:

This thing lives in your BIOS.
When the system starts, it searches for "autochk.exe" in your system folder, supporting both FAT and NTFS drives. Then it hijacks "autochk.exe" substituting its own code instead, which unpacks and starts the "rcpnetp" process. It also verifies the registry key [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Control\Session Manager] "BootExecute"= autocheck autochk.
When the Internet connection is up, it updates itself via the internet (connecting to 209.53.113.xxx - xxx.absolute.com), tries to send some personal info to the server and then listens to the instructions.
This crap is white-listed by most known antivirus packages that's why it was not found by my antivirus.
This crap has even created screenshots of my wife's activity and placed the JPG files into the %WinDir% folder, it gathered system reports about the laptop, our external IP-address etc. etc. etc.

How to fight this

If you find this process ("rcpnetp.exe") in the processes list, follow these steps:

Delete the files rpcnetp.exe, rpcnetp.dll from your system
Move autochk.exe to another folder
Edit the registry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute"=hex(7):00,00
Note that this crap will come back after reinstalling Windows
Note that you can forget about the checkdisk tool forever.

What's the big deal?

Now, this rootkit does no harm. But

I don't like that someone collects my personal info without my permission
I don't want my computer running programs I never approved
I don't like the possibility that a dishonest employee at Absolute Software can execute remote commands on millions of laptops. There's a name for this. It's called a botnet.
I don't like the possibility that some malware authors can piggyback this system.
I want to be able to CHKDSK my hard-drive for Pete's sake!!!

UPDATE: After some more Googling I discovered that this was a big news story about a year ago, and some (not all) laptop manufacturers have released BIOS updates that remove this rootkit... But my wife's laptop was bought on Amazon only 2 months ago, it's a Toshiba Satellite T135, and the rootkit is still there. I just tried downloading the latest BIOS for our Toshiba - and the "rcpnetp" is still there even after reflashing BIOS. So check your laptops! Esp ASUS and Toshibas. UPDATE 2: Turns out that the AVG free antivirus detects this as a rootkit and tries to remove the files. But - of course - it's back up after a system restart. UPDATE 3: Here's the patent for this thing.

UPDATE 4: I've just sent a support ticket to Absolute Software requesting to remove this tool, let's wait for their reply...

Why I hate IE6. And why I miss IE6

noreply@blogger.com (Alex) — Sun, 17 Apr 2011 14:28:00 +0000

I'm getting kinda tired of cross-browser development. Yes, I know... The more the better, competition rocks, rendering standards are great, FireFox is cool, Chrome is awesome, and the evil MSIE monopoly is sacrilege.

I mean, I do hate IE6. Just like I hate IE7. I even hate IE8 a little bit. And, of course, I hate IE9 (for that lousy font rendering and no proper CSS3 support). But I do miss the IE6-days. I never thought I'd say this, but I do miss the days when IE6 was The Browser For Them All.

I still have to support IE6 and IE7. I'm sorry, I'm not some big corporation to say "OK, we're phasing out support for the older browsers". I have a freaking ton of customers running older browsers, OK? Running all possible kinds of older browsers, actually. Including the stupid IE6. I cannot just phase them out.

But even without the older browsers there are still lots of issues with the newest non-IE browsers as well. I won't bore you with the details, but trust me - both Chrome and Firefox have their nuances. And every tiny piece of JavaScript, every non-trivial HTML-code has to be tested in a zoo of browsers. Not to mention mobile devices.

Cross-browser is fine, competition is good, the more the better... But I'm just getting kinda tired of this:

Now, to make this post not so boring, here's a great "History of Web Browsers" infographic by Shahed Syed that he kindly allowed me to publish here. The history of browsers and their popularity over time:

Lessons learned from The Traffic Spike

noreply@blogger.com (Alex) — Tue, 12 Apr 2011 09:47:00 +0000

My recent blog post about the Chinese hard drive has attracted HUGE amounts of traffic. It's been featured at TechCrunch, Slashdot, Reddit, StumbleUpon and others. Of course, after being upvoted at HackerNews - my long-time personal favorite.

It was "liked" by 14K (forteen thousand) people on Facebook and retweeted more than 2.5K times. My blog has received about 450 000 visits (and still counting) - thank God I host it at blogger.com, otherwise my server would be dead by now.

But what's in it for me and my startup? Let's have a look at the ups and downs:

Pros

Self-esteem and excitement. I'd lie if I didn't say that my ego was flattered. Come on, wouldn't you be happy to get this ~~shitload~~ impressive amount of visitors and mentions?
SEO-effect. The blog has attracted hundreds of links. Those links are completely outside of my business's target keywords niche (the most weird ones came from a marijuana-growing forum, German politician's blog and Vietnamese social network)... But I guess I'll still earn some "trust-rank" for my blog.
Brand awareness. Hopefully. In Vietnam and Germany, at least.
Conversion - I gained some new subscribers and Twitter-followers (read on for the exact numbers)

Cons

Low conversion rates. And by "low" I mean "almost zero". Only 15% of the visitors actually checked out some other pages on the blog. Out of 450 000 visitors only 500 people (0.11%) have subscribed to my feed and only 100 (0.03%) have followed me on Twitter. Another 100 (0.03%) visitors cared to view the "about this blog" page and only 400 people (0.08%) have checked my main (non-blog) website so far.

I'd call this kind of traffic - "carpet bombing" (as opposed to "laser-guided missile"). Still, the SEO effect should not be underestimated.
Comment-moderation is exhausting. The Internet ~~is full of idiots~~ has some unrestrained individuals. Every five minutes some Anonymous was posting an aggressive, racist, offensive or meaningless comment. I spent hours removing hundreds of the most awful ones.
Productivity drop. You end up checking your blog every half an hour, reviewing stats or the number of retweets. And - moderating comments.

Of course this does not mean that the "viral" approach is dead. You should keep creating great "shareable" content... Just remember that the "viral" traffic converts badly, the bounce-rate is 95%. It won't drive the actual sales. But do concentrate on converting this traffic into RSS or mailing list subscribers instead.

According to this great post by Rob Walling - every traffic source has a half-life and this was a striking illustration. Traffic spikes after being featured at TechCrunch, being upvoted at Reddit, being "Stumbled Upon" or retweeted - are always followed by a decay. And your job is to keep your website prepared to "The Traffic Spike" and make the most of it.

Unfortunately, my blog was completely UNprepared. It didn't even have an "about" page until last week...

Steps to prepare your blog

Add the "sharing" widgets to your pages where appropriate. Facebook "like" button, "retweet" button and a couple of bookmarking sites - are a must. You can use a service like addthis.com or add the buttons manually.
Optimize your feed: host your feed at feedburner to track your stats, ensure fast delivery and optimized markup. Add "share" and "retweet" buttons to all your RSS feed items. If you use feedburner, go to "Optimize" - "Feed flare" and add Facebook and Declicious. The "retweet" flare is not there by default, you have to paste this line into the "Add new flare" field:
```
http://erik.thauvin.net/download/tweetflare.xml
```
Call-to-action in every post: add a "subscribe" link to the bottom of every post of your blog. This includes the RSS feed (your RSS items will get published and republished many many times).
Content is king - OK, you must be sick of this one. But, guess what, it's still true!

Electronic Reader Running Doom 2

noreply@blogger.com (Alex) — Fri, 08 Apr 2011 07:47:00 +0000

Being a huge fan of electronic readers, I could not pass this up. This is a leaked video of Doom 2 running on "PocketBook 360 Plus" prototype, recorded by a PocketBook employee. To be precise, it's running PrBoom - a Linux port of the original game from id Software.

This looks pretty amazing - the FPS seems really nice for an e-ink screen.

UPDATE: I've just dug up that the e-Ink screen model being used on this device is "e-Ink Vizplex V110". Full device specs:

Screen - 5″ V110
CPU - FreeScale i.MX35 ARM11 533MHz
RAM - 128mb RAM

Chinese Magical Hard-Drive

noreply@blogger.com (Alex) — Thu, 07 Apr 2011 09:22:00 +0000

A Russian friend of mine has posted this absolutely amazing story.

He works at a hard-drive repair center in a Russian town right next to the Chinese border. A couple of days ago a customer has brought a broken 500Gb USB-drive that he had bought in a Chinese store across the river, for an insanely low price. But the drive was not working: if you, say, save a movie onto the drive, playing the saved movie back resulted in replaying just the last 5 minutes of the film.

The whole service center was rolling on the floor laughing. This was not the first time someone has brought a disk like that. And the previous drives were also bought in China... They opened up the drive right in front of the astonished customer. This is what they saw:

It's a 128-MB flash-drive. Working in a "looped" mode - when it runs out of space, it starts overwriting from the beginning. My friend said they're still trying to figure out how did the Chinese do that. Because the drive reports "correct" file sizes and disk-capacity. And the "looped-overwriting" does not touch the other files present on the drive.

The device looks pretty convincing - lots of tech labels and stuff... The Chinese salesman even saved something to the drive to demonstrate that it "works" in the store.

Happy Webmasters Day

noreply@blogger.com (Alex) — Mon, 04 Apr 2011 07:53:00 +0000

While deploying a new build of our hosted help-desk I ran into a bunch of "not found" service pages... And then realized that it's the 4th of April!

I think we should make the 4th of April the official webmaster's day.

4.04

Happy holiday to all the webmasters and web-developers out there!

PS. Actually, if you google for "webmaster day" you'll find that GoDaddy's customer support has declared it April 29. But that's just marketing. I guess "4/04" fits much better. Let's declare this day our holiday and celebrate de-facto!

ASP.NET Session: Caching Expiring Values

noreply@blogger.com (Alex) — Fri, 01 Apr 2011 10:36:00 +0000

Another post for ASP.NET/C# developers reading this blog. If you think these posts do not belong here, please leave a comment, and I'll consider moving my development articles to a separate blog.

Pretty often I need to cache something in the Session object, and expire the stored value after, say, 5 minutes. Just like it would in the ASP.NET Cache storage.

But the session state has no expiration concept. And the Cache object - well, cache is not specific to a user-session, it's application-wide. So I created this tiny useful extension class for this. Hope the code explains itself:

/// <summary>

/// this class saves something to the Session object

/// but with an EXPIRATION TIMEOUT

/// (just like the ASP.NET Cache)

/// (c) Jitbit 2011. Feel free to use/modify/whatever

/// usage sample:

///  Session.AddWithTimeout(

///   "key",

///   "value",

///   TimeSpan.FromMinutes(5));

/// </summary>

public static class SessionExtender

{

  public static void AddWithTimeout(

    this HttpSessionState session,

    string name,

    object value,

    TimeSpan expireAfter)

  {

    session[name] = value;

    session[name + "ExpDate"] = DateTime.Now.Add(expireAfter);

  }



  public static object GetWithTimeout(

    this HttpSessionState session,

    string name)

  {

    object value = session[name];

    if (value == null) return null;



    DateTime? expDate = session[name + "ExpDate"] as DateTime?;

    if (expDate == null) return null;



    if (expDate < DateTime.Now)

    {

      session.Remove(name);

      session.Remove(name + "ExpDate");

      return null;

    }



    return value;

  }

}

Protecting your startup's server from attacks

noreply@blogger.com (Alex) — Wed, 30 Mar 2011 15:00:00 +0000

Our server was kinda hacked the other day. The attacker has obtained an FTP password for one of our servers and was able to download some stuff - thank God nothing critical... While I'll save the details on the attack for my next blog post (this is quite a story actually! hackers have fooled our hosting company submitting a fake support request), I'm going to share some knowledge I've accumulated during the last couple of days dealing with the consequences.

NB: my small company is powered by a bunch of Windows 2008 R2 servers, but some of these recommendations should fit any platform, not just Windows.

So, here we go. The steps I took to protect my VPS server from future attacks:

Set up the lockout policy. By default your windows-server is not protected from a brute-force attack. An attacker, for instance, can open a thousand RDP (Remote Desktop) connections trying different username/password combinations...

That's why you must set up the lockout policy for your server. Open "Start - Run - secpol.msc - Security Settings - Account Policies - Account Lockout Policy". Set it to "5 times" and "5 minutes" for example - this will block an account for 5 minutes after 5 invalid login attempts.
Disable the "support user". If you rent a server, very likely there'll be a support user account for your hosting provider's tech team. Disable it. Sometimes the security is compromised by the hoster's staff (mine was).
No FTP unless required. Disable FTP, SMTP and other unneeded services unless your customers/applications really need it. Enable the FTP only when you're actually uploading files onto the server and limit it to your IP address.
Install a nice password manager. You'd be surprised how many people go for the "one password for everything" mode. Even some geeky tech nerds I know, even programmers and system administrators... Don't. Even the service accounts & database-users must have unique strong generated passwords only. I prefer the "LastPass" manager which is available as a Chrome extension, and it saved me a ton of headache.
Backup. Backup. Backup. Backup. Both on-site and off-site. Create daily backup-jobs on your SQL server to backup your databases both locally and online. Even if you're running the free Express version of MS SQL Server there are still ways to create periodic "jobs".

Here's our configuration: all databases are backed up twice a day - locally, and twice a week - to an online storage. For the online storage we use Microsoft SkyDrive, it offers 25 gigs of free space (which is pretty amazing) and comes with a sync tool. Another similar option to consider would be DropBox of course.
Firewall is a must. You can use the Windows Server 2008 built-in
firewall, it's pretty good for a start, and then upgrade to something more sophisticated later. The rule of thumb here is - DISABLE EVERYTHING. Leave ports 80 and 443 open - and that's it.
Don't use standard ports. If you need anything beside the web-server open to the public (e.g. SQL server, terminal services) - then move the applications to non-standard ports, some weird number like 15089 etc.

The Terminal Services (RDP) port can be changed in the registry, at "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber" (remember to restart the RDP service and allow incoming connections on the firewall).

SQL Server ports can be adjusted in the "SQL Server Configuration Manager" tool - "Network Configuraion" - "Protocols for [INSTANCENAME]" - "TCP-IP" - right-click - "Properties".
No "/admin/" folder or other standard names. Your website's CMS folder should not be named "http://www.website.com/admin/". Your admin user should not be named "administrator". The login page for ASP.NET forms authentication should not be named "login.aspx". Etc.. You get the point.

P.S. Dear attacker! If you're reading this - please let us know what you were looking for. Why not just send us a note and we'll give you what you need - for free... We provide free versions of our software to bloggers, non-profit organizations, we give away huge discounts etc. etc. We're a small friendly company, let's talk :)

Thank God Japan is well prepared

noreply@blogger.com (Alex) — Tue, 15 Mar 2011 19:06:00 +0000

This could sound outrageous. This could sound awful and even offensive. Please forgive me for saying this. But.

Thank God the reactor disaster is happening in Japan.

As you might know, I was born in Russia before moving to the UK. Or - to be precise - I was born in the USSR. I was nine years old when Chernobyl happened. And I was watching all the lying TV reports claiming that "there's only 7 people dead, calm down, everything is under control, nothing to worry about". The government even refused to take help from the international community.

And there was my father. A rocket scientist working for the military, he's been sent to that plant a couple of times. And he was telling me the truth. That the firefighters who came to the scene were never even told it was a nuclear reactor (so they wouldn't get scared). That a dozen of firefighting units had only two (2!) Geiger counters (devices that measure radiation) and only one of them was working. So it was 3:00 AM (two hours after the explosion) before they actually realized that the radiation levels were dangerous. That none of the firefighters wore any protective gear. That they were not told how dangerously radioactive the smoke and the debris were. Most died from radiation exposure within three weeks.

The truth that, contrary to safety regulations, a combustible material (bitumen) had been used in the construction of the roof and the rest of the building (that's why the fire was so difficult to fight). That the plant operators were given respirators and potassium-iodide tablets and were forced to continue working. That the reactor was shut down only 4 hours after the explosion. That the janitors were cleaning the building with bare hands and wet rags the next day.

So thank God it's Japan. Not Iran or North Korea. And not some backward country that wouldn't be able to handle this. I am sorry for saying this. I have lots of friends living in Japan and God knows we all wish this never happened.

Japanese are exceptionally well prepared for natural disasters. They are disciplined professionals. Their cultural background emphasizes code of honor. And I am sure that all those heroes who continue working on the nuclear plant despite the radiation levels are doing everything they can to save us from another Chernobyl. Our prayers are with them.

KeyFreeze - free tool that locks keyboard and mouse

noreply@blogger.com (Alex) — Mon, 14 Mar 2011 12:02:00 +0000

I have kids so I know what it's like, when they're having a Skype-talk with their grandparents - they keep accidentally pressing buttons, moving the mouse etc etc.

So I wrote a small free Windows app that locks keyboard and mouse while the screen stays active. Head over to KeyFreeze.com to download it.

Macro Recorder is dead. Long live Macro Recorder!

noreply@blogger.com (Alex) — Tue, 22 Feb 2011 21:13:00 +0000

It's been a while since I announced anything "official" on this blog, but this announcement is worth mentioning here.

Our four-months project is finished: we have completely rewritten Jitbit Macro Recorder to the .NET platform. It's a HUGE amount of work done. It seemed unbelievable, absolutely unachievable when we started it... But here we are. It's been published on our website and it works. Even on our old XP-based test computers.

What's so great about the new version?

Why, there are several huge advantages:

1. The "ClickOnce" technology - Microsoft's deployment framework that enables the user to install and run an application by simply clicking a link in a web page. It even has a built-in auto-update feature. Which means - critical fixes and improvements reach Macro Recorder users faster. It works almost like in a web-application: we release a fix - all users get it instantly.

2. The .NET Framework - I'm so tired of C++ and VB6... Yes, I know, C++ is "cool". But I'm tired, sorry. The .NET framework makes the development process amazingly fast. Adding new features and releasing updates for the Macro Recorder has never been easier for developers. And - we made the application compatible with .NET version 2.0, which makes it compatible even with the oldest Windows computers.

3. Code-signature - the application is now "signed" with a security certificate from Comodo. Which means - no scary "untrusted publisher" boxes when a user installs our application, no false alarms from antiviruses and firewalls.

Oh, don't get me started on this! Comodo (the certification authority) has been pestering me for weeks. They asked for my phone bills, they asked for copies of all documents possible, written signatures, bank account statements, utility contracts, address verifications... They called my cell phone and my landline number to verify we exist. In the middle of the night, of course, since I'm not in the US (I actually had to tell them how to dial outside the US: "dial 011..."). It took me dozens of emails, 5 lengthy support tickets, faxes... But it was totally worth it. Now I have that magic certificate that tells our users "those guys are real, relax and run the installer".

4. Lots and lots of minor fixes throughout the application.

I'm keeping my fingers crossed cause I've never been that scared in the history of Jitbit Software. Jitbit Macro Recorder is dead, ladies and gentlemen. Long live Jitbit Macro Recorder!