TechRant

Why Apps Are Dead.

Matt French — Wed, 11 Apr 2012 11:00:10 +0000

Available on the World Wide Webstore.

Each and every one of us is guilty of causing what will result in the death of the downloadable app. Millions of sales worldwide for apps such as Angry Birds, and high grossing apps for companies such as Zynga(who have 3 apps in the top 10 grossing after purchasing OMGPOP, the creators of DrawSomething), require users to purchase in-game paraphernalia, are all factors which blind us into not seeing this coming.

Angry Birds as an example, already has an in-browser edition of its most popular game. Facebook and Twitter, both have their own mobile sites which are identical mirrors of their downloadable apps. My point here, is that the technology doesn’t need to be in an app, and actually requires extra work to do so. Sooner or later the whole thing will crash, as more people uptake usage of online mobile versions.

The likely responses to this are that many games wont do this. It’s not practical. But, at the forefront of web development, and in upcoming standards, there are signs that browser creators are doing all they can to make the browser more friendly to games. Most importantly, allowing data to be stored for offline use. Already being used to certain extents with video. One of my favorite examples is Rawkets, a multi-player anonymous game. This could so easily have been an app, but was developed to showcase what can be done with recent web technologies – and is much better because of it.

With internal mobile memory being limited and apps taking up far too much room – this transition just makes sense. New mobiles like the HTC One series, have ditched the port for expandable memory, once your storage space is full – you need to uninstall apps. If a developers app doesn’t cut it, then its gone! Unless they provide a web-based app for the user…

If by this point, you really don’t believe me, then take a look at Jolicloud OS and the Chrome browser in particular. They offer apps (The chrome webstore and the latest Jolicloud apps). All of them web based. It wouldn’t take much for developers to scale things down and offer mobile versions. Mozilla themselves have been working on a whole OS built on HTML and utilising the cloud, gearing it towards games, the OS could even ship integrated with things like the Gamepad API, already seen in a Firefox nightly build.

So maybe they aren’t quite dead yet, but as the usage of mobile sites increases with time and developers start to take notice, people will expect to see a website they can visit. They will expect to be able to see all of the functionality from the app (arguably this is a must from a usability point of view anyway). But most likely, web based applications will be the first port of call.

Where do you think apps will go in the next two years?

© mattfrench for TechRant, 2012. | Permalink | 7 comments | Add to del.icio.us
Post tags: Firefox, mozilla, web apps, web based games

Why The Enterprise Sucks

Ian Kent — Sat, 24 Mar 2012 12:10:57 +0000

Looking over some of the past articles I’ve written for this site, I feel I’ve been missing our collective intention: to rant about technology. It’s in the name, after all.

In light of this, I will now proceed to moan about one of the most infuriating things (in my opinion, of course) about technology: ignorance towards it.

There is no better illustration of techno-ignorance than the enterprise—the sheer complacency toward anything with a microprocessor is rather staggering. Yet it’s the enterprise which should be the most interested in technology, and the scope it has for delivering improved productivity, higher profits and lower wastage is unbelievable. Yet, for the most part, those within the enterprise couldn’t care less whether Windows Mobile 6.1 isn’t the latest and greatest in mobile computing.

To clarify, I work in ‘the enterprise’ (although, I’ve never been fond of that phrase, it implies much more productivity and innovation than is inherent within ‘the enterprise’) so I have a vague first-hand experience of the laissez-faire nature of technology awareness that is generally found in the industry. You could say I’m behind enemy lines in this regard.

So, to get back to my point, why is it important to have an awareness of what’s happening in the technology space when you work in a professional setting?

I’m very glad you asked.

The enterprise, by definition, is about extracting the maximum amount of wealth from an activity as is physically possible, for yourself or your client—or most likely both. Therefore, productivity is the buzz word we’re going to be thinking about here; making more efficient the activities that are making a profit, and cutting the frequency of the activities that are making a loss. Business 101.

How do we make our business more productive? Well, we can’t really make our staff radically better at what they do; that’s not where the innovation is going to come from. We can’t just go laying off people or charging more; that’s unsustainable. The only real space where innovation is going to come from is in the tools we use—i.e. technology!

As an example, if you’re in the retail business, how much more productive is the store going to be if there is a radical improvement in the software used to track stock levels & wastage? Well, quite a lot! More efficient stock monitoring and wastage management is going to save you money on logistics and replenishment. End of.

So why is the enterprise so reluctant to care about technology? Why do we live in a world where more often than not you’ll be sitting in front of IE 6-8 at work? Why is that seen as OK?

For the life of me, I can’t answer that question. I can understand how the prospect of updating software and machines can seem daunting; it’s quite a high-cost task. That cost will pay for itself, though, in the increased productivity the firm will see. So is this all just down to near-sighted executives?

Again, I’m in no place to be able to answer these questions.

My point is, the enterprise sucks. They use Windows XP, Blackberries, IE and more often than not COPIOUS AMOUNTS OF PAPER.

So, there’s my rant. Order restored?

The Perfect Blend of Storytelling and Atmosphere, Dear Esther

Garin Richards — Thu, 22 Mar 2012 12:30:22 +0000

I didn’t discover Dear Esther until the day after release, the 15^th of February. It wasn’t a Joystiq, or r/gaming story that informed me. It was the front page of the Steam store that told me of its release. I was confused—I mean, what kind of game calls itself Dear Esther? And why is it on the front page?

Little did I know that Dear Esther was an original mod released in June of 2008 for Valve’s source engine. After reading some of the discussion going around the web, I wondered how I could have missed out on something that had such an anticipated launch. After a couple more reviews and comments from fans, with remarks like “one of the most haunting and well-executed titles of this or any other generation” intrigued me. The fact that it was also being described as a “ghost story” solidified my desire to purchase, and my wallet said hello to its old friend, the Steam marketplace.

As stated, Dear Esther was marketed as a “ghost story”, a new concept to me, but it makes complete sense after playing the game for just a couple of minutes. It’s a little difficult to explain exactly what it is, but I’ll do my best.

There are no weapons, only a flashlight that shows its presence when the situation warrants. You cannot jump, nor can you sprint. You are forced to traverse the unnamed island at a painstakingly slow pace. There is no combat, nor is there any real interaction with any other player, or NPC. It’s only you, the narrator, and the island.

When played on a proper graphics card, Dear Esther promptly shows off the potential of the updated Source Engine, with environments that make any scene screenshot worthy, and details that have stopped me in my tracks more than once. There are only so many words I can use to describe how great Dear Esther looks, only screenshots and trailers (at the bottom of the page) can do it justice.

Not only does it look great, Dear Esther sounds just as awesome. The soundtrack, written by Jessica Curry, is nothing short of amazing. Walking along the shorelines and cliffs, the solemn, creepy atmosphere is amplified by the first eerie notes of “The Beginning”. My personal favorite is “The Cave” with its whispers and other creepy sounds. One of the few soundtracks that I have come to appreciate, it has made its permanent place within a playlist on my own computer. It is also available to download from the ModDb page.

To try and sum up the two hours I had taken to complete Dear Esther, I can only say, “engrossing”. There hasn’t been a game that has kept my attention as well as Dear Esther. I was constantly intrigued at what the narrator was going to reveal next, what was around the next corner, and what everything was leading up to.

I cannot remember the last time that the conclusion of a video game has rendered me speechless, this just may be the first. It has completely changed the way that I view gaming as an artistic medium. It is a piece of art, and completely exemplifies what our favorite form of entertainment can do.

The Chinese Room has also recently stated that they will be helping to develop the next Amnesia title, “A Machine for Pigs”. I stand by and eagerly await their next release, for they have earned themselves a fan.

http://www.youtube.com/watch?feature=player_embedded&v=D7VJ4lP-05A

Notes:

Dear Esther was released on Valentine’s Day 2012, and is available on Steam for 9.99 USD (Or £6.99 of your finest pounds).

This review was done with the pre-patched version of Dear Esther.

© garinrichards for TechRant, 2012. | Permalink | One comment | Add to del.icio.us
Post tags: chineseroom, dear esther, dearesther, gaming, indie, mod, steam

How to Recover Your Firefox Session When All Hope is Lost

Ben Hutton — Tue, 20 Mar 2012 12:30:05 +0000

Last week my house had some electrical issues, and our landlord came round to take a look at things. During this time, my computer got turned off without warning when a fuse was removed. It recovered fine, but next time I went to shut down in a hurry, Firefox was hanging around, and I wanted it dead. I chose to kill it and shut down—a mistake I would soon regret.

When the fuse and power were restored and my machine booted up again, I opened Firefox. It asked to do a session restore, as it had closed down with an error. That’s fine, no problem; I did force quit and the restore has always worked. Not this time. It DID load all my open tabs, probably about 100-130 or so… every single one of them… blank, with no URL. I don’t have all those tabs open at once, but in one session—most of which is stored in Firefox’s grouped tabs feature.

Many hours had gone into collecting those tabs. Several of them were tabs of projects put on pause, a few article resources, plans for future projects, random research and reading I wanted to finish at some time. All lost. I was under the false impression that Firefox by default stored several sessions, but sadly it does not. This can be achieved with a plugin which I’ll get to later.

I had a frantic panic and it took about half an hour to sink in that I’d probably never see those tabs again. Because I’d spent so many hours gathering them, however, I decided I’d try and get them back, somehow. I figured the data must be stored somewhere, and maybe Firefox just wasn’t loading the URLs because the file was corrupt.

After a bit of poking around and Googling, I found the profile data is stored in the appdata folder (%APPDATA%\Roaming\Mozilla\Firefox\Profiles\[RandomNumber]) on Windows (you may or may not have the “Roaming” folder). If you’re a Mac user, you should find the profile data at ~/Library/Mozilla/Firefox/Profiles/ or ~/Library/Application Support/Firefox/Profiles/. The files you’ll be looking for is sessionstore.js and sessionstore.bak. Firefox automatically creates a backup encase of crashes, but if like me, you opened and closed Firefox several times before realising this, you will have overwritten both these files several times.

At this point, I almost gave up. I figured the chances of recovering the session data file was pretty low. Having successfully used file-recovery software before, I decided to give it a shot. On Windows I use Recuva, made by the same people as CCleaner, and it’s free. If you’re on a Mac and you don’t have Time Machine or (for whatever reason) don’t have any form of backup enabled, you can have a look at some Mac-based alternatives.

Now I knew what file I was looking for, where it was, and how to recover it. Because of the way the NTFS file system works on Windows, when you delete a file (from the recycle bin), you actually just delete the index to the file, allowing that space to be reused. Recuva knows this, and searches for un-indexed files on the drive. It sometimes only recovers partial files, but I was lucky enough to find a completely untouched version of my sessions file.

After the file was recovered, I moved it to the correct location and re-opened Firefox. JOY! After the huge worry, I decided to installed Session Manager, a Firefox plugin which allows some clever session management features, like backing up x number of previous sessions, something I thought was already in place.

If you have had a similar horrible Firefox (or other browser-related) experience, let us know in the comments below.

© Relequestual for TechRant, 2012. | Permalink | 28 comments | Add to del.icio.us
Post tags: browser, Firefox, mozilla, session, tabs

BarCamp Bournemouth – Live Blog Day 1

Ben Hutton — Sat, 03 Mar 2012 10:11:15 +0000

Barcamp is an unconference. People sign up to attend and are invited to give talks on whatever technology or computer related topic they like. There is also a hackspace provided by one of the sponsors Mozilla, which we will be visiting! Thanks to the other sponsors, Bournemouth University, BCS, and atechMedia, and thanks to Paul Albinson, Lewis Davies, Dan Heath and Luke Wiliams for organising the whole event.

Today and tomorrow, myself and Kieran will be live blogging the event. This is our first live blog, so please bear with us if any problems arise. Your page will be updated automagically, so no need to refresh.

04.09

Arduino? No problem. Playing music? Confusion supreme

17.53

Well that’s all the talks for today! For the rest of the evening and night, coffee fueled coding is the name of the game. We may or may not update through this evening, depending if anything awesome happens in the hack room. Thanks to those following the live blog today. We will be back tomorrow with more content and insight into BarCamp Bournemouth 4.

17.04

And now, for some powerpoint karaoke! A presentation on Adele… in Spanish?! And what is levanters?

16.52

Problems with node (and their solutions):

Callback spaghetti, development pattens, keeping everything Async!

Async libraries (Q & async), Prototypal Inheritance / Module patten, A new way of thinking!

Tom uses node because it’s new and exciting, but it also allows applications to scale easier than with PHP

16.47

Now @tomgco (Tom Gallacher) is giving a talk on node.js

Why would you use node.js? Who uses it? What’s good about it? And why does Tom hate CoffeeScript so much?

16.23

Hackroom photos! In this room (Spock), everyone is sat around playing with gamepads and the Gamepad API, arduino bits, and code.

"Stop talking about chips, I've got code, I'm gonna use code!"

There are all sorts of hardware bits here that are admittedly way beyond me

16.21

“Using the UI builder for iOS set me back. Learn to make views with code”

16.15

From earlier:

The sexy @jonginn with his @horse_eBooks tshirt http://t.co/FNtJCrzQ

03/03/2012 5:13 PM via Twitter for Windows Phone ReplyRetweetFavorite

@ScruffyFox

Callum Taylor

16.11

There are quite a few things to learn to make an app, but Rome wasn’t built in a day.

Objective-C is a super set of C, using the same basic syntax, but object-oriented.

Using Cocoa, a bunch of high level APIs for OS X with the MVC design patten, you can write apps for iOS devices.

16.01

Introduction to iPhone apps by @phillipcaudell in the Paper room. 83,000 downloads in one day for their best app!

Why and how to build an app!

15.01

And now in Spock, our very own Ben Hutton (@relequestual) is giving a talk / workshop on how to make Eclipse less… well, rubbish.

Yoxos is a tool that allows you to build your own custom build of Eclipse, without all the rubbish that comes with it, allowing you add or remove components before installation. Ben, as a PHP developer, wants to optimise his Eclipse installation to include all the PHP development tools he’ll need, without needing to install them later as a plugin. He’s walking us through the process of doing this with Yoxos.

14.39

Did you know, font-face has been in IE since version 4! Other browsers removed it, then added it again.

14.33

There are fonts built to help dyslexics read texts easier. Does anyone have a website where you can enable a dyslexic mode?

14.20

Helvetica. It’s overused! But don’t use Arial.

Arial is crap, an imperfect version of Helvetica.

14.13

Right now in the Paper room, @jonginn ‘s guide to fonts!

Font choices are Paramount!

13.20

Adam’s talk went into live examples using IRB, but due to overwhelming demand quickly degraded into the Duck Song.

13.12

It’s lunch time. Free food provided by the sponsors! THANKYOU! =]

12.59

Map, Reduce, Zip. Things I’ve heard of but never understood. Now I know! Check out the code samples in Adams slides linked below!

12.50

Now: Adam Howard (@skattyadz) giving a talk on Code Tricks. “Those of you who know no code may be in over your heads; or you may feel patronized if you know any code at all, really.”

So far, he’s gone over conditionals, and the ternary operator, and been hijacked by someone in the front row defining what ‘true’ means.

Also, “JavaScript is MENTAL.”

12.49

Javascript is mental Fair comment. Now talking about Coercion – Code Tricks slides can be found here http://slides.skatty.me/slideshows/6/present

12.47

Truthyness and Falseyness. True and False. Conditional stuff… [pic]

12.40

Adam Howard (@skattyadz) talks about some code basics

12.17

Some more lessons learnt: Take breaks, have a spec, work for the right reasons, learn git, pick something and stick with it, off and on again isn’t always the answer, don’t dither, always remember your tools, upgrade, use streetview…

12.05

Fail Swap Shop is fantastic! Some lessons so far…

Don’t show off, don’t try too hard, VM is a waste of a time, test, backup, think before you speak, RTFM, smaller chunks, prepare, think before you act, check the time, backup your backups, don’t be sarcastic to the customer…

How it works

Hi, my name is [name] and I’m a failure. *cheer* I did x and it failed, I learnt that…

11.38

Coffee time followed by the Fail SwapShop. Time to share failings!

11.27

Mozilla are working with the Chrome guys to create a consistent games API – at the moment, while Firefox allows event-driven button presses, Chrome only allows the other method of capturing gamepad input: continuous polling of the gamepad to see if its state has changed at all.

Both Chrome and Firefox dev releases include the Gamepad API (requiring you to enable a flag before starting the browser), and it will be coming to consumer releases Soon(TM).

There are six gamepads here to play with, and to try your hand at the API. I’ll definitely be taking a look at this when I get a chance. The sample code from this presentation will be going up as a gist shortly.

11.12

The Gamepad API will be in every version of firefox in the near future. It uses Javascript and you can determine when a gamepad is plugged in!

Rob shows us a demo of a graphical gamepad in HTML5 taking input from a gamepad connected via USB.

Gamepad have identifiers so you can tell you what the layout of buttons are.

11.07

Session 1 in the Spock room, Gamed API introduction by Rob Hawkes.

10.56

And we’re go. We’re in Scissors room (the other rooms are Rock, Paper, Lizard and Spock) having an opening talk from the organisers… including showing off hackspace prizes! There’s a box full of Arduino stuff, and four copies of Foundation HTML5 Canvas: For Games and Entertainment by Rob Hawkes for whoever makes the best / most amusing / stupidest thing this weekend.

10.13

Doors opened just over 10 minutes ago! Crazy Tom Gallacher is wearing jumping stilts, but for how long! *rushes to barcamp*

Windows 8: Death of the Laptop

Kieran Patel — Fri, 02 Mar 2012 12:30:29 +0000

I’ve been using my Windows PC more and more often these days. And happily, Windows isn’t sitting still at version 7, with the Windows 8 Consumer Preview available for download now, and with over a million downloads already (one of which is me). The Start button has gone, refreshing the desktop paradigm for the first time since ’95, the Metro interface reigns supreme, gestures run amok (with multi-touch coming to ultrabooks… hmm) and the gap between ARM and x86/64 chips closes further.

And you know, I think all this proves that Microsoft really do get it, this concept of ‘no-compromise computing’. Being the ‘computer guy’, I’m often asked by non-technical friends which laptop to go for. You all know the question—budget of £400, wanted for a light bit of Facebook, some browsing, the odd bit of spreadsheeting. And you all know that any—any!—traditional laptop you buy for £400 (that’s a little under $650) will be absolute rubbish, and will simply not stand the test of time. When suggesting that these kids shell out a little more for a decent laptop (read: MacBook), or just get something more suited to their needs and in their price range (some sort of tablet—the iPad (while not a PC and as much as I can’t stand it) is for them—or a ChromeBook) they’re having none of it. Invariably they come back to you two years later, when the junk they bought is unusable, asking the exact same question.

It's junk. But it's junk thousands of people buy.

Because they’re stuck on Windows. The build quality of budget laptops, even notebooks, alongside the nature of traditional desktop OS’s, is detrimental to any sort of long-term machine health. We know this.

So the whole concept of Windows 8 is exciting to me. One OS for tablets, laptops (touchscreen Ultrabooks!) and desktops alike. A unified experience, and a step in the right direction to changing people’s ideas of what makes a ‘computer’. A step towards people buying a £400 tablet to be their primary machine because it has Windows, and it’s running the applications they’re used to on their abysmal £400 laptops. And maybe it’s too early to say, but perhaps they’ll last longer, too. Perhaps the Metro interface will prevent users from being able to screw up the system, in the same way iOS devices don’t get as fudged as today’s Windows manages to do. On the flip side, a desktop OS that has features such as suspending background apps would be really something.

One OS to rule them all, one OS to find them...

And it really does work, too, the whole universal OS thing. On a PC, you never have to leave the desktop interface. You can run the ‘traditional’ Windows experience. Oh, and if you want it, then the Metro overlay is of course but a finger twitch away. And yes, it does actually work with no touch interface: the new keyboard shortcuts do their job just fine, and of course the mouse works successfully as a pointing device (albeit with some hiccups when it comes to scrolling; something Microsoft are aware of and claim will be fixed in the RTM). On the other side of the coin, the Metro UI is an incredibly capable tablet interface—I might argue the most capable, going by the glorious Snap view and smooth gesture inputs, and the insanely useful ability to plug in a mouse, flip out a stand and swipe over to Desktop mode, a feature I’m hoping will kill off the poorly-made budget laptops/notebooks outright.

And if you do want to be using multiple devices? Windows 8 syncs using ~~iCloud and an Apple ID~~ your Microsoft Account (interestingly dispensing with the Windows Live branding). It’ll sync with your Windows Phone (if you’re one of the three people with those) and with your Xbox. It’ll feature an App Store—and I’ve high hopes of this integrating with Xbox in the future, too, meaning I can buy Halo 16 for both devices with one transaction (much like I can buy both Mac and PC versions of a game on Steam). Oh—and the quality of the apps in the store is phenomenal, too. Metro truly is beautiful.

Yeah, there's no real excuse for this.

So is it all glory Microsoft, now? Have the tables been completely turned on competitors since the fiasco of Vista? Windows Phone 7 and the rise of the Xbox 360 seem to think so, but of course Windows 8 still has some Microsofty hitches: it is still same old Windows underneath, with some architectures and components dating back 15 years or so. Internet Explorer is still Internet Explorer, with serious issues with transparency even in its 10th iteration. And that ribbon on Windows Explorer—oh, God, why?! But Windows 7 is, for its flaws, a capable operating system, the most popular ever, and Windows 8 seems to improve madly upon that. With its shift to ARM and tablets, too, I think it’s a given that the OS is going to do well. iPad killer? Hardly. People still go shopping for ‘an iPad’, not a tablet. But other iPad competitors—and definitely Google—should be quaking in their boots, because of course users are going to be swayed by an operating system they’re used to. That’s the reason the £400 laptop buyers are scared of the ChromeBook, and why low-powered Linux-based netbooks (“true” netbooks) never took off either. I only hope that a £400 tablet won’t be as much a piece of junk as a bottom-end Inspiron is today.

The ball’s with the hardware manufacturers now.

UPDATE 16 Oct 2012:
Well, as it turns out, Microsoft wasn’t willing to put all its trust into the hardware manufacturers either. The pricing for the not-countertop Microsoft Surface was announced just minutes ago, and lo and behold, it’s £400 (or £80 more if you want that snazzy keyboard with it, which, let’s be honest, you do). Its size, form factor, the fact that it looks like a cute little laptop with a Cover and kickstand, and the all-important fact that it’s running Windows, the OS people know, are all pretty killer features. And oh, that keyboard.

I can only hope that it draws people in and really takes off, putting the final nail in the coffin of awful budget laptops.

The ball’s with Microsoft’s marketing department now.

Microsoft and Nokia: Making me love cyan® since the early 21st Century.

© Kieran for TechRant, 2012. | Permalink | One comment | Add to del.icio.us
Post tags: Microsoft, operating systems, software, Tablets, windows, windows 8

PLEASE Stop Doing Passwords Wrong!

Ben Hutton — Mon, 06 Feb 2012 12:25:22 +0000

A few days ago I had the pleasure of attending a local “digital creative” meetup B&Wmeet. It’s held at the Slug and Lettuce, a national pub chain in the UK. A number of us wanted food before the event, and I noticed an offer on their website of 25% off food if you sign up for an account. Money off food for a student always sounds like a good idea, so I signed up. Next thing I know, I have an email in my inbox… with my password in plain text. This resulted in an unhappy and slightly angry Ben.

UPDATE: We heard back from Aardvark Media “The Slug and Lettuce website does not store your password in plain text. At time of account creation, we send a one-time email with the plain-text password, as we’ve found sites that do this see a marked drop in the number of users of any “Forgotten password” facility they provide.” Well that’s a relief! For the full response, see the comments section below.

Anyone who works in web development (should) know about security issues when it comes to storing data—especially passwords! One of the simplest security errors is storing users’ passwords in plain text. That’s just stupid. Why would you store passwords in plain text? Plenty of Fish do, and as dspillett from hackernews puts it “My opinion? PoF stores password in plain text because it is an unprofessional outfit with no care for the security of its users or their data.” Storing a password in a retrievable encrypted format doesn’t cut it, either; it only takes one rogue or unhappy employee or your database stolen, and your passwords could be at risk.

Let’s admit it: the main problem here is password reuse. If you use a different password for every account you log into, having one password stolen (from the system with the weak link) will (hopefully) only result in a few random forum postings. If you have the same password to your bank account that you do for a random forum your friend made on a weekend, chances are your password is just waiting to be stolen, along with your money. Here is a comic from xkcd about password reuse.

Regardless of the reuse issue, when a website or webapp is storing your details, they have a level of responsibility to make sure it’s kept safe. If a website includes its own very clever way to store passwords, it’s probably broken and not very safe at all. Using already existing libraries to handle password hash storage makes sense. These libraries are generally open-source reviewed by people who understand them. As the saying goes, “If it ain’t broke, don’t fix it.” What happens when it does break, though? Crackers will always try to find quicker and slicker ways of cracking, and rainbow tables did just that (assuming they stole your database of hashed passwords). In the past, using an MD5 or SHA1 hash with a salt was good enough not to be cracked within a reasonable time.

Luckily, some clever folks came up with bcrypt, an (effectively) adaptable hashing algorithm that can keep up with Moore’s Law. It uses Blowfish at its core and salts, but the main benefit of bcrypt over something like SHA512 is it was designed to be slow; it’s not really a hashing algorithm. Hashing algorithms are designed to digest a large amount of data and provide a string which can be compared with another to check for message integrity. They are fast by design. Some discussion over which is better still remains, but from what I can tell, bcrypt is going to be secure longer.

We’ve established you should be using trusted, well-used code for authentication, and I hope I’ve made it pretty clear that it’s not acceptable (but unprofessional) to send users their passwords in plain text via email! There are ALTERNATIVE ways to do the whole “Forgotten Password” thing. I was sent my password in plain text after sign-up. Why? I can only assume because someone thought that convenience was better than security. They were wrong. They are wrong. Very wrong. Wrong wrong wrong.

Wrong.

To make sure it’s not just my opinion that it’s bad, I asked a few people on Twitter if there was ever a valid reason. Here are a few responses…

@relequestual no.

31/01/2012 5:02 PM via Twitter for Mac ReplyRetweetFavorite

@phillipcaudell

Phillip Caudell

@relequestual Definitely not. Anyone who says otherwise hasn't properly thought things through.

31/01/2012 5:04 PM via Echofon ReplyRetweetFavorite

@Angry_Lawyer

Tony Aldridge

@relequestual spying?

31/01/2012 5:03 PM via Twitter for Mac ReplyRetweetFavorite

@skippychalmers

James Chalmers

@relequestual no but I suspect a lot of older systems either don't encrypt or have a way for a password to be shown in plaintext

31/01/2012 5:10 PM via Twitterrific for Mac ReplyRetweetFavorite

@grahamcrosbie

Graham Crosbie

The trouble is, Graham is right. There are, and probably always will be, a number of systems and websites out there that do it wrong and either can’t or won’t ever be upgraded. A way you can deal with this, is to use different passwords for every account, which are impossible to remember. Personally I use LastPass, which is a very secure way of storing your passwords, and making them accessible. If you want to know exactly how it works, check out this transcript from an episode of Security Now (A fantastic and recommended security podcast). The main point, is they never store your decryption key, and you only ever send them encrypted data, as encryption and decryption is done client side. Plus, it has a few really neat extra authentication methods for the super paranoid.

A final note on password strength: I’m sick if seeing password requirements of “must include upper and lower case, must include 3 numbers and 2 special characters.” No. It DOES make it more secure if you don’t handle brute force attempts by not locking accounts, but there is a BETTER way, which makes brute force even harder, as this xkcd comic shows…

The next time you are responsible for implementing the authentication element of a website, think. Remember this comic. Suggest to your users not to reuse passwords. Explain to them that you won’t be sending them their password in an email for THEIR protection. If you fail to do these things, you really aren’t helping the current state of username and password authentication.

Developed an authentication system before? Let us know how and why in the comments below.

© Relequestual for TechRant, 2012. | Permalink | 3 comments | Add to del.icio.us
Post tags: algorithm, authentication, bcrypt, Blowfish, libraries, passwords, rant, xkcd

The Usefulness of Books in The Age of The Web

Jack Hayter — Thu, 12 Jan 2012 12:25:43 +0000

There seem to be two camps of developers these days. The first are those who read books—physical books you can put in your lap. The second group are those individuals who consume all of their research material online. I would place myself somewhere in the middle for the very same reason that the second group exists: finding content online is very easy. I’d far rather pick up a good book and read the printed pages than to read a web page or blog article, but like so many others, find doing so impractical in a society where all the facts you’ll ever want are just a click away.

There’s something very satisfying about sitting down with a physical printed book and a cup of coffee and reading about the subject and learning new things. I don’t find that using web resources offers me a comparable experience as I tend to be looking for the solution to a very particular situation. I don’t pretend to know all the answers, but here are my views about what the future holds for printed reference material, as well as trends I have noticed.

Why do I read books?

I can see in my room 14 different reference books on the topic of programming alone. Add that to my collection of recipe books and fiction—that’s a great deal of paper! So why do I find this at all practical or useful when Google holds all the answers?

It’s all about the mind-set of an individual. Call me old-fashioned, but I find that sitting down in the evening with a cup of hot chocolate and a novel is far more relaxing than watching television or playing a FPS. Neither should you call me a technophobe—I’m a computing student at Bournemouth University and worked for Microsoft on my placement year.

The truth is that I find it easier to consume a comprehensive documentation of one author’s thoughts on a broader subject base than a thousand authors’ thoughts on a thousand sub-topics. I prefer the subtle humour and the quality of material that you find only in printed books and not on a blog, for example. This quality is really the main reason for my preference of books. Publishing houses have very high standards and rigorous procedures to ensure the content is accurate and well worded. A post in a forum, for example, simply isn’t subject to these sorts of restrictions.

What about other developers?

I have a lot of developer friends, not only through my studies but also through my work. I’ve found that in general the older ones tended to have more books on their shelves than the younger ones. That said, I don’t know how often those books are picked up.

This raises another interesting point: in what way are these books read, and how often?

For me (and I know for others as well), the most significant factor considered is the time investment necessary. Developers, in particular, want answers quickly since their productivity relies on speedy response to questions. Reading a book cover to cover does take time, but that simply isn’t the way reference books are used. Personally, I read the introduction, maybe the first chapter, and then skip to whatever I’m most interested in; a process that on the surface appears to be the way people use the web—start off on Wikipedia, then read a few other results from Google.

Reference books are not designed to be read like a novel, they’re meant to be picked up and put down whenever and wherever needed. This is what makes a physical copy so good—you’d have a great deal of trouble reading a blog or forum on the London Underground, for example.

The Future…

I’ll stand up and defend the printed book as much as I can, but I must confess the web has some fantastic advantages over books—that is precisely what it was designed for in the first place.

First, web sites are generally free to use. If I am looking for answers or wanting to learn something new, I’ll always find free reading material online. Printed books on the other hand are very expensive. Programming references for example, can often be found priced at £40—a significant investment by anyone’s standards.
Second, the web is fantastically comprehensive. Regardless of the subject, no matter how obscure, the internet seems to hold the answer. Books, although comprehensive in their own right, are expensive to write and publish and, are therefore often cover a broad subject matter.
Third, search engines such as Google or Bing make finding this content effortless. A few carefully selected keywords can bring you hundreds or thousands of relevant results. A printed book is often a lot harder to get your hands on.

These three factors are, for me, the biggest reasons why I am using the internet more and more. There is a wealth of knowledge online which is simply unparalleled by any bookstore or library. With so many web sites designed for programming Q&A’s, blogs about development and tutorials sites, there is no shortage of resources to suit everyone.

There are many wildly different opinions about what the future holds for the printed word. The extremes: some believe that the internet has made books redundant already, other suggest that we will always have them.

So where does all this leave the printed book? Well, for me, as satisfying as holding a piece of dead tree might be, it simply isn’t as convenient as a web search. I see printed reference books becoming obsolete in 5 to 10 years. However, the quality offered by books over other online sources will surely guarantee their useful life beyond that. The future is quite clearly about eBooks. With the majority of publishers making their content available to providers such as Amazon with their Kindle platform, how long will it be before the printing presses fall silent altogether?

Next time you’re reading a tutorial or help forum online, ask yourself: ‘How does the quality of this compare to a book?’ and ‘Would I prefer to read this from paper?’

Let us know your thoughts on this subject and your predictions for the future of printed books.

Responsive Web: Now and Next

Tim Stone — Tue, 20 Dec 2011 09:30:32 +0000

Recently, web designers have rallied under a new banner: ‘responsive web design’. The term coined by Ethan Marcotte and popularised by his book of the same name has caused something of a renaissance as to how we view the web. We always knew it was capable of fluid designs and that it wasn’t the same as print, but only now are we beginning to discover the full potential of what it means to make a website.

What is responsive web design?

A brief primer for the uninitiated: responsive web design is about shifting, omitting or adding content depending on the size or orientation of the display. For an example of this—and one of the first to do it before it had a name—was the ever-brilliant Jon Hicks. Resize your browser window and see how the columns remove themselves, the navigation re-positions itself, the logo scales proportionally; in short, it’s beautiful. To achieve this, Jon uses CSS media queries which are surprisingly well established.

So responsive web design, from a non-technical perspective, means more websites will be better optimised for your screen real estate than before as more designers use it. My real aim, though, is to talk to you about a lesser-talked-about technique that I believe falls under the same banner.

Context-aware browsing

Increasingly, sites will drop the navigation bar to follow you down the page. A couple of examples are TechCrunch and Creep Fest. I was trying to think of a name for this technique and did think context-aware browsing summed it up quite nicely, it knows where you are on the page and reacts accordingly until it dawned on me: This is another example of responsive web design!

An insightful overview of what’s currently happening to the web was described in Mike Driscoll’s Node.js and the JavaScript Age, we are transitioning from an age of static web pages to “a global digital nervous system”. I adore this analogy, HTML is the skeleton, content the organs, CSS the skin, and JavaScript the nervous system. With a combination of CSS and JavaScript, pages react to what the user does and where the user is, both geographically and within itself.

Advantages

CSS media queries have a wide, standardised implementation. Even if the mobile browser you’re using doesn’t support it, it will support percentages in your CSS, so, if you’re using a grid system, simply drop 960px to 80% and you’ll have a fluid website at least.
Your site will be more accessible to mobile device users. We know there are large shifts away from desktop usage and offering a streamlined experience, I believe, is a big part of that. Mobile users generally have different priorities to desktop users. On the B&W Meet website we decided that people would be looking for a map and location details so we made this a priority on the small-version of the site.
Platform agnostic. It doesn’t matter if you’re using a Symbian browser or the latest Mobile Safari, it’ll behave the same lending itself to the “write once, deploy everywhere” paradigm.
You have full control over the content positioning. There is no ‘magic’ attached to this, you simply use pure CSS to position content as you would in any other site.

Limitations

More technical knowledge is required. To use techniques like navigation bars that stick to the top of the page past a certain point, JavaScript is essential.
‘The full experience’. Some believe that by providing an optimised view, that they are missing out on important content. Sometimes, this is the case; someone may make an editorial decision and decide that some content is superfluous for mobile users. I’m not convinced these people are using responsive web design ‘correctly’. It’s all about giving as similar experience as possible and prioritising content, not losing out on it.

Where next?

I believe this age of Responsive Web Design will see innovators playing with not only websites that respond, but online UIs too. Mobile users have different needs and priorities to desktop users and I believe many conventions can be taken from native mobile apps in this sense by taking these considerations into account. Next time you’re browsing TechCrunch or any other responsive website, ask yourself, ‘does this benefit me?’ and if so, ‘how’s it done, could it be executed better?’

Got any good or bad examples? Let us know!

Paying your web developer—how and why you should do so

Ollie Read — Mon, 31 Oct 2011 12:30:18 +0000

This is something many developers and designers can connect with. For the purpose of this article, I shall be focusing on the developer’s point of view (mainly because I am a developer).

Scheme

Image from Espos

As I imagine many of you do, I have a scheme to handle payments which is used in a good 80-90% of the projects I take on. Due to the nature of development work, projects can be anywhere from a week to 6 months long, but, in my experience, they more often than not come in around the 1-2 month mark. Bearing this mind, most clients with find it unacceptable for the entire project to be paid outright before any work is undertaken, and many developers will find it unacceptable to work for 2 months with no payment whatsoever.

Client’s point of view – If everything is paid upfront, then there’s no guarantee that work will be done, and the individual and/or company involved won’t simply disappear with the money, and it’s very daunting to see a large sum suddenly leave your account.
Developer’s point of view – If the project is large enough to require almost full attention continually for the duration of the project, then there will be no income over this time and (obviously) bills will need to be paid. This also being said, there’s a chance that you can complete the work and have the client refuse to pay, meaning you have wasted a lot of time and have a system that doesn’t really have a purpose.

With these points in mind, and in hope of keeping all parties happy, I offer a 4-payment scheme, which is broken down as follows:

25% – Non-refundable deposit to guarantee my time
25% – Once the design has been signed off
25% – Once the system is complete
25% – When the site goes live/Site is handed to client

A lot of the time, the last two payments fall at the same time, but on occasion, though a system will be complete, a client will want to do various other things (perhaps marketing) before the system is actually released. As standard practise, I will not hand over the code and IPR (if required) until the final sum is cleared.

The scheme above will be used as the basis for the rest of this article.

The Deposit

The deposit is an initial payment (more commonly weighing in at 25% of the total cost), which guarantees the time to work on your project, by covering the developer(s) for the first quarter of the project. As a personal rule, I won’t start work on a project until the deposit is made; as many of you can relate, at any one time I’ll have several quotes out, and to be perfectly honest, if I were to start a project with no deposit and another quote were accepted with a deposit, I’d be torn between two states of mind. I’d want to continue the work because I’d already started, but want to go on to the other project because (obviously) the client paid, and turning down money is just downright stupid.

Notes on deposits for clients

Please remember that simply saying that the deposit has been made isn’t sufficient. If the deposit hasn’t arrived in the account, then work simply won’t start on the project, and if it has been sent by cheque (we’ll get to these shortly) then work won’t start until I have set time aside to pay the cheque into the bank, and it has cleared successfully.

Always remember to pay your deposit via a BACS transfer (which is instant), and in a swift manner, so the work can be started.

Cheques

Image from dmjarvey

Oh, cheques—where to start with you little buggers!

Simply, cheques are the bane of my life. As a self-employed individual who doesn’t drive, I have to walk to the town centre to pay the cheque into the bank. It’s not the walking that bothers me; it’s the fact that the journey itself, there and back, will take me a total of an hour, plus the 10-30 minute wait in the bank to speak to somebody to get the cheque paid in. This means, in total, I have wasted around two hours—and simply walking to town and paying the cheque in and then walking back is a TOTAL waste of time.

So when I need to pay a cheque in, I have to schedule everything so people are aware I won’t be available for the majority of the day, and so I can do everything I need to do in the bank/town centre when I go up there, so not to waste a visit. All the while, I’m hoping that a client doesn’t attempt to contact me about something urgent or some new work.

Another thing is that cheques will more commonly be sent via post, and mysteriously disappear somewhere in the Royal Mail system. The rule of thumb here is that 9 times out of 10, if you post a cheque into a postbox before the postman empties it, it’ll be on the recipient’s desk by the following day—so using this as a way to delay paying is pointless. Also, a little side note for you:when a letter is received by Royal Mail, they stamp it, so when I received your cheque (posted two weeks ago, if I ever receive it, that is), I know that it wasn’t, in fact, posted, until the day before I received it.

I’d also like to point out, that of the 4 payments in my career that were made via a cheque, and sent via Royal Mail, I have received a grand total of 0.

Notes on cheques for clients

If you HAVE to send a cheque and there is no way around it, either deliver it yourself, or have it sent via recorded delivery. This way, you can check on the status as well as see who received it, as recorded deliveries require a recipient signature.

Do not say that the cheque has been sent, then actually send it a week or two later, because that gives us (the developers) the impression that you think we’re stupid, which is never a good start.

Final payments

The final payments are very important, especially if you actually want what you’ve paid for so far. Trying to skip out on these just simply won’t work.

Image from serenityphotographyltd

If you agreed to the original cost, and if there were any extra work involved, and there is written (email) proof that you acknowledged and accepted these charges, you simply cannot get out of paying. You can threaten legal action as much as you want, but I find it hard to believe, that, no matter how good a legal team you have, any court in its right mind would sanction an individual and/or company to hand over something that hasn’t been paid for in full, according to the original verbal/written contract, and according to any further amendments.

It’s my understanding that, in the eyes of the law, the IPR would reside with the developer until all payments are made and the requirements of the original contract are met.

More often than not, a client KNOWS that he’d stand no chance in a court, but simply threatens it because he wants to scare you into giving him the code so he can keep his money. Think about it like this: if he’s willing to pay the fees to have this taken to court, then why not just pay the goddamn final payments? Seriously!

Notes on final payments for client

If you refuse to pay the final payment, you can kick up as much of a fuss as you want. You just simply won’t be given the code—plain and simple.

But before you try to avoid paying for something you agreed to, take this hypothetical situation into consideration:

All the code has been done, and you’ve paid 3 of the 4 payments and you outright refuse to pay the fourth. As I stated previously, you’d have no grounds to force the developer to give you the code.

The developer now has a system that’s complete. He needs to get the money back for the work he’s done, and, providing there were no NDA’s and there is no reference, no logos, trademarks, copyrights or intellectual property of your company’s within this system, the developer can do as he pleases. At this point, he has three choices.

Write it off as unpaid and let the system sink to some directory on some backup hard drive

If the system is a nice one, and something that could be easily run and used as another source of income, he could rebrand it and set it up himself.

He could sell the system in hope of getting back the hours, if not making a nice little profit.

The first option is obviously the best from your point of view, but the worst from the developers point of view.

The second option is obviously bad for you. as you’ll need to spend time finding new developers to rip off; meanwhile, your old developer will be making money through a system originally built for you.

Now, if your business is in direct competition with another, then the chances are this system has something you competitors don’t—different features, or features based on theirs, but improved. Whatever the case, if this system were to go up for sale and the developer advertised it properly, individuals likely to be interested would be in the same sector as you, meaning that this system could simply be sold on to your biggest competitor and you’d have lost your edge, which will affect your business considerably.

Conclusion

My point here is to try to (hopefully) explain to those of you who try to skip out on deposits, or delay paying developers because you don’t have the funds, or you’d simply rather they did it for nothing, how this can have a negative affect on yourselves.

My understanding (which may be somewhat limited) is that all of the above practises are legal, if done correctly. (If this is not the case, feel free to contact me and clear some points up!)

If some points in this article appear somewhat harsh, or you believe that I am being unprofessional, I urge you to take a look around you and your own business. Everything mentioned here is pretty standard business practise, and, as harsh as it may seem, it’s just the way the world works.

Summary for clients on above section

Pay your developer, or you’ll get shafted—and the law will be on the developer’s side.