Here, for example, is the url to Django-Tastypie’s PDF docs:

http://media.readthedocs.org/pdf/django-tastypie/latest/django-tastypie.pdf

You can replace django-tastypie with the slug for any Read the Docs project.

I wrote a tiny userstyle to hide Google Plus notifications on Google and Gmail. I’ll update it as necessary.

For over two years PGO has put up with my oddities, like buying AskJeevesMom.com. I never received warnings to stay on topic. The GNOME community is the most friendly and welcoming online community I know. #gnome-hackers was my home as a teenager and I don’t think I heard a dirty word once. The GNOME community simply rocks.

Knowing that my posts end up on PGO has always made blogging seem like a bold and glorious undertaking, though I felt a midget among giants. My posts end up on the same page where HP blogs and Mark Shuttleworth announces.

Tonight I’m saying goodbye because in three weeks my blog will be removed from PGO and I support that decision.

You see, my blog was once about GNOME and Linux. When I was added to PGO in 2009, I was a new and passionate GNOME user who blogged about Zeitgeist. Today I use OS X and occasionally GNOME 2. I used to be passionate about FOSS, but nowadays I’m a student and I’m just happy if I eat two meals a day, preferably with a cup of fresh squeezed orange juice, assuming that isn’t over-budget, but of course it always is.

It has been a pleasure. If you want to follow me, subscribe to my blog’s RSS feed, follow @aantn or plus me - or even just email me. Do people still use RSS? I still use email.

So long and thanks for all the fish.

I wanted Politician Market to be entirely static site, so I used JotForm for signups. There were so many sign-ups that I crashed JotForm’s servers after only 10 minutes and had to move the sign-up form to Google Docs.

Signups and Conversions

Conversion tip: If you want to optimize sign-ups, don’t use  an external service. Sign-ups stopped almost entirely after moving to Google Docs. (I received only 40 signups after the move.) If you want to gain feedback, do place a feedback form on the homepage and you’ll get plenty of feedback.

12,000 uniques and 4 hours later, Politician Market mysteriously disappeared from the homepage and traffic started to subside. Some time before then, I had to disable the contact form entirely because I was about to overrun my JotForm quota. Despite disabling the form, people kept submitting it, often blank. (A browser bug?) At that point, I changed the form’s action to “#” and added an overlay (see below), but people kept submitting the damn form. My brother told me that he wrote me a long message in the contact form, because he was convinced that it really did get sent after all. What must you do for people to believe you?

Another conversion tip: Adding social sharing buttons seems to matter. There were 12,000 hits while we were on HN for four hours. After pg killed the submission, the long tail brought (and is still bringing) another 2k. If you add sharing buttons, make sure to include Google Plus. The break down was 259 shares on Twitter, 40 on Google Plus, and a bunch on Facebook. (For an unknown reason, Facebook wont show me the stats anymore.)

I didn’t have time to A/B test, but conversion rates seemed to rocket when I placed annoying sharing links so far up that they pushed content below the fold. I hated that, so I soon reverted the changes. (Startup idea: I wish I could run automatic A/B tests by including a javascript file that would hash the page, check with a 3rd party server to see if it changed, and provide conversion data when I’m cowboy coding. Create that and I will pay a one time $10 fee for the service.)

For absolutely no reason, I asked for phone numbers in the signup form. About 30% of all sign-ups included them.

Avoid AppEngine Like the Plague

I originally wanted to host on S3, but it wouldn’t accept my credit card so I used AppEngine and static-app-engine-hoster. Don’t do that. There is no caching and you lose all the benefits of a static site. I wasn’t expecting so many hits, so I didn’t think this through.

More on AppEngine: Deployment is easy, but payment sucks. AppEngine makes you pay per-week, so if you want to use $10 a day, you have to deposite at least $70. (Slimeballs.) AppEngine has absolutely no support for paying customers. I sent two emails about urgent issues and never heard back. Avoid AppEngine like the plague.

Publicizing

I tried publicizing Politician Market on Reddit, Slashdot, and Digg. It almost took off on Reddit, but Slashdot ignored it despite votes on the Firehose submission and Digg was a laughable waste of time. (What they say about Digg is correct: If you aren’t part of the oligarchy you might as well submit the link to /dev/null.) I emailed a few tech and political bloggers. Most of them ignored me, but some had incredibly kind words and published a link. Do have the chutzpa to email bloggers.

This is the second launch I have done. Third time ice cream. Does anyone know where that weird Israeli saying comes from?

I’m off for Hanukah and I want to donate a few holiday hours to a charitable project. Do you know of a good cause that could use a C hacker or independent Python web developer? Let me know and I’ll donate four hours tomorrow night, with the goal of continuing to help out during the new year.

Are you a coder yourself? Can you pledge the same? Send me an email and we will code for good tomorrow.

Update: Join us in #holidayhack on Freenode!

Termbrot iterates over points in the complex plane, animating the image as it discards points from the Mandelbrot set. Get it on GitHub.

I didn’t search for Magic or hotkeys. It’s okay to auto-correct, but give me an undo link.

“Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts. This reliably prevents private data from being sent out without your knowledge. Little Snitch runs inconspicuously in the background and it can also detect network related activity of viruses, trojans and other malware.” — Little Snitch website

Foreword

Programs like Little Snitch instill users with a false sense of security. Mac owners often use Little Snitch to prevent pirated applications from dialing home and to ensure that cracked versions of software don’t contain spyware. Nothing could be more naive: If an attacker can run code in the right context, it’s game over. Apps like Little Snitch can’t possibly prevent that.

Keep in mind that this specific attack could have been prevented, but there are more insidious ways to bypass Little Snitch. The security model is broken by design.

How to bypass Little Snitch

Once a binary is allowed access to the internet, Little Snitch will continue to allow access even if the binary changes. On OS X, applications are usually installed by dragging them to the Applications folder. This means they are owned by the user who installed them. Firefox and Chrome take advantage of this to auto-update without the root password. We can use this to overwrite binaries.

We bypass Little Snitch by replacing a trusted binary with our own executable; it will execute with the network-permissions of the original app.

Example

We need a binary that connects to the internet and we can’t use an interpreted language. For your convenience, here is one such program.

Download it. Then compile as follows:

brew install curl && brew link curl
make

You can ensure that Little Snitch is working by running ./payload.

Lets backup Firefox and replace it.

mv /Applications/Firefox.app/Contents/MacOS/firefox{,.orig}
mv payload /Applications/Firefox.app/Contents/MacOS/firefox

That’s it. If you were writing a program that needed network access without permission,  you would do this programatically and execute Firefox. That’s not the case here, so launch Firefox manually and examine /little_snitch_example.txt

Lastly, you probably want to use Firefox again:

mv /Applications/Firefox.app/Contents/MacOS/firefox{.orig,}

Closing Notes

In real usage, you should examine ~/Library/Application Support/Little Snitch/rules.usr.xpl to pick the right binary.

Lastly, all testing was done on Snow Leopard. You may need to tweak this for Lion or the App Store.

In memory of Dennis, here is a short history lesson about C prototypes. Have you ever wondered why the following is legal?

#include <stdio.h>;

void foo () {
    printf("Goodbye, World!\n");
}

int main (int argc, char **argv) {
    foo(1); /* Call foo with a non-existent parameter */
    return 0;
}

---------------
$ gcc test.c -Wall -Werror
$ ./a.out
Goodbye, World!

This is legal for historical reasons. In pre-ANSI C function prototypes didn’t include parameters. C89 introduced parameters in prototypes, but it continued to recognize the old syntax for backwards compatibility.

If you want to declare a function foo that really takes no parameters, use void:

void foo (void);

Anyway, you can’t just install lxml with pip (the preferred way of installing Python libraries) because lxml depends on a recent version of libxml2. If you try, gcc will stop when it encounters missing headers added in later versions of libxml2:

libxml/schematron.h: No such file or directory blah blah blah

Instead, use the fabulous Homebrew to install a newer version of libxml2 and then run pip with that version.

brew install libxml2
pip install lxml --install-option="--with-xml2-config=/usr/local/Cellar/libxml2/2.7.8/bin/xml2-config"