I recently started investigating the ways I could develop a mobile application (especially Android), which is the right and/or fastest way and how could I improve my overall thinking when it comes to mobile development. The only method I used ’till now is the native one. I relied on Android application framework and I liked to take care of all the little details, even if those details slowed the development process a little bit. I’m talking about details like custom layouts on multiple screen densities. Not necessarily a hard thing to do, but still time consuming. Sometimes even working with system services seem hard to debug or test properly. I wanted a tool that could help me with those little details and let me concentrate on application logic, rather than the sub-components.

But after discussing with other developers, I discovered PhoneGap, an application framework, which allows developers to write native, mobile applications using HTML5 and JavaScript. And it isn’t the only one. I found out that there are a lot of other frameworks like this one, which provide high level APIs  for the most common mobile components and even more, can open the mobile development world to a web developer. You can find a list of the most used frameworks here. But wait, there’s more. Most of these frameworks are multi-platform, which basically means that you can cut the development costs in half, by coding once and deploying that code on Android, IOS, WP7 and other platforms. This seems to be great, but portability has it’s own costs.

How does it work ?

What PhoneGap actualy does is create a web container inside a native application in which you can run your own JavaScript code, using HTML5 for the user interface and taking advantage of the main system features through a JavaScript API. You can do almost anything that you can do in a browser, including AJAX calls in order to exchange data. Here are some samples of some quick cool stuff:

Taking a picture:

navigator.camera.getPicture(onSuccess, onFail, { quality: 50,
    destinationType: Camera.DestinationType.DATA_URL
 });
function onSuccess(imageData) {
    var image = document.getElementById('myImage');
    image.src = "data:image/jpeg;base64," + imageData;
}
function onFail(message) {
    alert('Failed because: ' + message);
}

Geolocation:

navigator.geolocation.getCurrentPosition(onSuccess, onError);
// onSuccess Callback
//   This method accepts a `Position` object, which contains
//   the current GPS coordinates
var onSuccess = function(position) {
    alert('Latitude: '          + position.coords.latitude          + '\n' +
          'Longitude: '         + position.coords.longitude         + '\n' +
          'Altitude: '          + position.coords.altitude          + '\n' +
          'Accuracy: '          + position.coords.accuracy          + '\n' +
          'Altitude Accuracy: ' + position.coords.altitudeAccuracy  + '\n' +
          'Heading: '           + position.coords.heading           + '\n' +
          'Speed: '             + position.coords.speed             + '\n' +
          'Timestamp: '         + new Date(position.timestamp)      + '\n');
};
// onError Callback receives a PositionError object
function onError(error) {
    alert('code: '    + error.code    + '\n' +
          'message: ' + error.message + '\n');
}

Notifications:

// Vibrate for 2.5 seconds
navigator.notification.vibrate(2500);
// Beep twice!
navigator.notification.beep(2);
//alert
navigator.notification.alert(
    'You are the winner!',  // message
    alertDismissed,         // callback
    'Game Over',            // title
    'Done'                  // buttonName
);
//Alert callback
function alertDismissed() {
    // do something
}

Of course you can make use of those other common features like file system, contacts and so on, but what bothers me is that the application will look and feel like a web application. I mean, it’s basically just a mobile browser and, from the user-interface point of view, you are limited to it. This might not be a problem for some users or clients, but others expect to see the native UI, the native theme, transitions and accessibility. Here are some screenshots of some cool apps made with PhoneGap.

A dashboard	Buttons and forms	A journal (basically, a list)	A list of options

As you can see, there is a lot of flexibility in terms of design, and you can reach a very large scale of devices and platforms, after all it’s just HTML, CSS and Javascript, therefore you have to accept that you can never mimic the native look and feel using this type of approach, but still you can use a touch-optimization framework like jQueryMobile (or Sencha’s Touch visual features) in order to create a “mobile” feel. It looks good, but the web-browser  is still felt.

Titanium

Titanium Mobile still uses JavaScript as a main application language but it also fixes this UI issue by rendering native user interface components at runtime, using the native  javascript interpreters from each platform. And yes, you would still have the cross-platform advantage (although Titanium’s approach is “write once, adapt everywhere“). It looks wonderful and the UI is so consistent and responsive. One issue that bothers me is that you don’t have access to declarative layout, meaning that each component has to be manually initialized… Even so, the fact that it reaches a large scale of devices makes it very suitable for companies that need to reach many users. Let’s see how some visual components are initialized in Titanium:

A simple button:

var button = Titanium.UI.createButton({
   title: 'Hello',
   top: 10,
   width: 100,
   height: 50
});
button.addEventListener('click',function(e)
{
   Titanium.API.info("You clicked the button");
});

A slider:

var slider = Titanium.UI.createSlider({
    top: 50,
    min: 0,
    max: 100,
    width: '100%',
    value: 50
    });
var label = Ti.UI.createLabel({
    text: slider.value,
    width: '100%',
    height: 'auto',
    top: 30,
    left: 0,
    textAlign: Ti.UI.TEXT_ALIGNMENT_CENTER
    });
slider.addEventListener('change', function(e) {
    label.text = String.format("%3.1f", e.value);
});

As you can see, Titanium’s APIs are straight-forward and easy to learn. You may notice that there is a naming convention that all the methods that return new UI elements start with the word “create”, thus being more verbose. Each UI component has it’s own implementation on each platform, so if you create, let’s say, a button, it will always be native on Android, IOS, WP and on the other platforms supported. Just take a look on the following screenshot, notice that it represents the same application on Android and IOS.

So, which one ?

It all depends on the project. I would use PhoneGap for an improved version of a website, if the company or the product already has a website. This would be much efficient, because you already have the data model which you can use through AJAX calls. Being able to access some device functionality like local storage or geolocation might enhance a website’s experience on the mobile world. An example of a good PhoneGap application would be, in my opinion, Facebook for Android. If I were to learn something from it is keep that web feel on the mobile and do not try to mimic the mobile UI using HTML, you might realize that you have started on the wrong foot. But, again, it all depends on the goal. If your goal is, let’s say, to sell computer parts, maybe it’s better just to create a mobile version of your website, having in mind that a user is familiar with browsing a website on the mobile device.

I guess it all comes to pleasing the user. That’s why, in some cases, the native look and feel is a must. And it’s not just all about the looks. It may look good, but it’s more than that. A native UI has many things besides looks. It has accessibility, it is fast, it is power efficient and, above all, it’s the UI the user has grown familiar with. We should consider other aspects, too, like package size. Of course you can expect the smallest size from a native application (up to 100 Kb, without any assets). Using PhoneGap you can expect an application size of a few hundred kilos, but with Titanium, the basic HelloWorld application can be 10 times larger, reaching 3-4 Mb. It is true that package size grows proportionaly with the number of the devices supported (different screen densities), but the framework adds its payload nevertheless. If size is a concern, you might not want to use Titanium.

Finally, you can use any application framework, as long as you do not want (or need) to create games or interact directly with low level features like services, graphics etc. And Titanium and PhoneGap aren’t the only ones. Here is an extensive list. One thing that still needs to be mentioned is that most of these frameworks are extensible through plug-ins, so if you need some custom, exotic functionality, you can implement a plugin yourself.

What is Drupal? CMS, Framework or Platform?

Most people see Drupal as a content management system – and they are right to do so.

“A content management system (CMS) allows publishing, editing, and modifying content as well as site maintenance from a central page. It provides a collection of procedures used to manage work flow in a collaborative environment.”

Out of the box, Drupal provides many features you would expect from a modern CMS.
It helps users:

• organize, structure and manage content with an easy-to-use web interface,
• handle a variety of content types including video, articles, blogs, podcasts, polls
• organize and manage users, user roles and access control.

However, ask a developer, engineer or architect involved in the community “What is Drupal?” and you may get a slightly different response. They will probably tell you that Drupal is a Content Management Framework.

I certainly agree with this point of view and I see the CMS part of the project as an implementation – a proof of concept, if you will, of the framework.

“In computer programming, a software framework is an abstraction in which software providing generic functionality can be selectively changed by user code, thus providing application specific software. It is a collection of software libraries providing a defined application programming interface (API).”

Drupal “ships” with a rich list of APIs, libraries and subsystems that enables developers to extend the Core functionality in a modular / pluggable fashion.

The most important framework APIs and libraries include:

• Module system (300+ Core hooks)
• Database abstraction layer
• Menu system
• Form API
• File management system
• Field API
• Search system
• Node access system
• Theme layer

In the beginning of this article, I described Drupal as a Content Management Platform so let’s see if the shoe fits.

The keys to any successful software platform are:

• Efficiency: The platform should enable its users to do key tasks quickly.
• Standardization: The platform should conform to a documented set of standards and best practices.
• Scalability: Rather than referring to server load, this means that any product built on the platform has to be easily repeatable.
• Extensibility: It should be easy to add features and functionality.

An excellent example of these concepts and practices is the whitehouse.gov website. Rather than being a single large website, whitehouse.gov includes a collection of 100 microsites – one for each representative. This was achieved through the use of Drupal’s installation profiles – a key feature of the platform.

“Installation profiles are scripts that run once when a new Drupal website is initially installed by running the install.php script. A standard installation profile is included with the Drupal core software, and additional installation profiles are available that pre-configure Drupal for various specialized purposes.”

Other mature software platforms, like Linux, have a variety of distributions and Drupal makes no exception.

“Distributions are full copies of Drupal that include a full version of Drupal core and may also include additional software including extra themes, modules and installation profiles.”

There are currently around 200 distributions and installation profiles available for download on drupal.org.

Drupal development and collaboration within the community

Perhaps the most important strength of Drupal is the community itself. Hundreds of thousands of people cooperate and constantly produce new modules, themes, documentation, translations, installation profiles and distributions. These are known as “contrib” projects.

You can find nearly 10.000 contrib modules on drupal.org – 3800 of which are compatible with the latest stable release of Drupal Core (Drupal 7). Each of these modules leverage both the Framework and the CMS in order to extend the core functionality and provide new features.

After attending a training a few weeks ago, hosted by Google, I decided to write this article in order to share some of the most important things I learned during this event. The training was part of the relatively new Google Engage for Agencies program.

If you’ve never heard of the Google Engage program here are a few details that might interest you:

Google Engage is a program designed to help agencies master the marketing art on Google. It offers its user free training, AdWords vouchers and marketing materials. Joining the program is simple: you sign up, pass the basic training and receive 10 AdWords vouchers, then find new clients and open up new AdWords accounts for them where you will use the voucher codes.

The program also gives you the option of becoming a Platinum Member. This of course comes with a few perks: vouchers of greater value, personalized materials and dedicated live training. There are only three conditions you must fulfill in order to become a Platinum Member:

1. the total budget of your clients must be at least $1000
2. you must have am MCC account used to manage your clients’ AdWords accounts
3. you must be a Google Certified Partner

So far there are 400 agencies around the world that have signed up for this program. 150 of these agencies have managed to get new clients using the AdWords vouchers.

Click here for more details about the Google Engage for Agencies program.

The presentations

Apart from the short presentation at the beginning about the Google Engage program and its evolution from when it was launched 4 months ago, there were 4 more presentations.

1. In the black with colored letters of Google

This first presentation was held by Martin Gaubitz from e-wolff. He talked about how you can start earning money using AdWords. Here are a few tips from his presentation that I found interesting and helpful:

1. it’s very important to be visible: there are many different ways in which you can increase your visibility, for example: have a website, make cold calls to potential customers, host events, get recommendations and partnernishps
2. manage customer expectations: show your knowledge by creating case studies and obtaining Google certification badges you can place on your site, get more experience by working with clients from different domains, sign fair contracts that offer transparency and measurable results
3. offer your clients additional services – for example: SEM/SEO, Webanalytics, Coversion Optimization.
4. and the most important thing (or ‘The big secret’ as Martin called it): Just Do It!

2.  Optimizing a Google AdWords Campaign

- presentation held by Tudor Marian. Here is a summary:

1. in order to best optimize a Google AdWords Campaign you must start with the campaign structure and settings – make sure your ad groups have a certain topic and corresponding keywords, also make sure your campaign targets your specific demographic (user location and language)
2. the second step is to optimize your list of keywords (analyze what keywords your potential customers use to find your products or services), make sure your ads are convincing and have a strong call-to-action, and establish your bids and budget so that you make sure not to lose any potential clients.
3. and the final step is optimizing the landing page – make sure the content of your landing page matches what your ad promises and that it’s simple for the users to register conversions.

A few tips that I found helpful and applied on the campaigns I manage were:

• checking how the keywords perfom for the three different match types (broad, phrase and exact) – some keywords might have a better CTR with a lower CPC if the set match type is ‘exact match’. Even though for my campaigns there wasn’t a great number of keywords that performed better under ‘exact match’, it’s still a good way to bring in better quality traffic and save as much money per click as possible.
• checking what keywords triggered which ads – this is a good way of finding if there are certain keywords that you should include in your campaign because they bring quality traffic. It’s also a good way of finding keywords that you might want to exclude because they’re not really accurate for your site.

3. Google Analytics & Website Optimizer

There were also two more presentations, held by Norbert Simionescu, one about Google Analytics and the second about the Website Optimizer Tool.

A few important aspects from the Analytics presentation:

1. your tool is only as good as your ability to use it
2. success is defined by your objectives (it’s important to define goals for your site; what you expect your clients to to on the site)
3. bounce rate can be a good way to see if your pages (landing pages) are useful to users, or if the keywords that brought the users to the site are accurate.
4. the new version of the tool alows you to set automatic alerts (for example you might set an alert that tells when the bounce rate exceeds a certain limit)
5. the new verions also introduces real-time reporting – that shows you exactly how many users are on your site and how they interact with the site

Although the presentation of the Website Optimizer tool was quite brief, here are some important aspects to consider:

1. start testing different versions of pages that aren’t performing the way you were expecting (for example landing pages with a high bounce rate)
2. test different pictures or messages on the landing page (for example a different picture for the users that visit the site in the morning and a different picture for those visiting in the evening) – it’s important to mention here that a users will never see different versions of the site.
3. the tool is free, easy to use, does not impact SEO and has been known to increase conversions

I must admit I have not yet used the Website Optimizer tool, but I would very much like to try it out in the future. I think it would be very interesting to see how changing an image or a header on a landing page affect the way users interact with the certain page. It would also be interesting to see if a certain version of a page would trigger more conversions.

If you’ve worked with the Website Optimizer Tool, I’d be very interested in reading what you think about it and how it helped you improve your site.

Also, any other tips about Google AdWords campaigns or the Google Analytics tool are more than welcome.

Managed and Un-Managed Code

First I would like to go a little bit further to explain what managed and un-managed code means.
A managed component (which can be an .exe file, an ActiveX control, a DLL and so on) means that it runs under the CLR that .NET provides. Nevertheless, it can execute in other CLR implementations such as Mono.

On the other hand, an un-managed component runs outside the CLR (so outside the control of the virtual machine), it can have access to Win32 APIs and is typically coded in C/C++. The latter are also recognized to have a lower footprint in terms of system resources.

Visual C++ Studio can produce both managed and un-managed code, while Visual C# Studio generates manged code only.

Introducing the DOTNET class

But how comes that you can actually load and consume such a DLL in PHP ? Well, this is because the managed DLLs have a “built in” component called OLE Automation Layer. This is basically a COM subset that expose a set of  interfaces so that a DLL can be consumed at run-time without prior compiling knowledge. COM is one of the main methods of gluing components on Windows platform.

PHP interacts with .NET DLLs via the DOTNET class. This one simply instantiates a class available with the DLL so you can call the public methods and properties. There are a couple of things you should consider here:

1. you have to have the .NET framework installed on the system you are playing on
2. you have to be aware of the DLL structure in order know what class(es) to instantiate and what method(s) to call – more details in a minute

Consuming an existing DLL

At a first look, you need to simply give it a try an load it in PHP with the DOTNET class. Sounds simple enough, right ? However you will quickly find out that DOTNET class loads DLLs from the Global Assembly Cache (GAC) only.

Fortunately for us, we have a command line tool called gacutil.exe that can add DLLs to GAC with the press of a button. If you’re on Windows 7 it should be located under
c:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\Bin\
or
c:\Program Files (x86)\Microsoft SDKs\Windows\v6.0A\bin\.
Once you find it out, just run the following command on the console
gacutil.exe -i “\path\to\dll-file.dll”.
The “i” flag tells the program to add it to GAC.

Once the DLL is added to GAC you will need another more detail to make it work from PHP. That is to find the corresponding Public Key Token that was assigned to your DLL.  A simple way to find it out is to open Windows Explorer and navigate to “C:\Windows\assembly”.

And this is how you invoke it from PHP:

$phpdotnet = new DOTNET("PhpDotnet, Version=1.0.0.0, Culture=neutral, PublicKeyToken=07a115ce41e79116",
"PhpDotnet.HelloWorld");
$phpdotnet->GetTitle();

Attention must be paid at Version tag. You must use the same version number as indicated in GAC. The “PhpDotnet” string,  in the second parameter of DOTNET class constructor, indicates the namespace the class is being part of, while the ”HelloWorld” string indicates the actual class you want to instantiate.

Each class within the DLL must be instantiated separately.

Let’s do a quick recap: (1) register the DLL to GAC and (2) identify the Public Key Token and Version Number.

When making your own DLL

To prepare your own DLL to be used in PHP or any other applications in fact, you will need 2 additional steps.

1. The first one is to make your DLL “COM visible”.

To do that from Visual Studio, you need to go Project Properties -> Application tab -> click the Assembly Information button -> check the “Make assembly COM-Visibile” checkbox.

2. Then you will have to strongly name your DLL.

To do that in Visual Studio, go to Project Properties -> Signing tab and click the “Sign the assembly” checkbox, select “New” and fill in the opened form, as indicated below.

Once you do these two things and compile your DLL, just stick to the above procedure regarding GAC and you’re done with it.

Known limitations

There are few issues when doing this integration that you might want to consider:

1. Public methods

Just like the PHP manual says, the returned object is an overloaded object which makes PHP unaware of the public methods the object might contain. So, if you var_dump it, you will see nothing but an empty array. That is why the inner DLL class structure mus be known prior to calling it.

Luckily for us there is another tool specialized for this job shipped with the .NET framework called ildasm.exe. It is located next to gacutil.exe under
c:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\Bin\ or c:\Program Files (x86)\Microsoft SDKs\Windows\v6.0A\bin\.
To load and display the DLL structure simply call “ildasm.exe \path\to\your.dll“.

2. Parameters

Another issue is that you cannot pass parameters to a class constructor within a DLL.

3. Data types

Being two different programming language, we have different data types involved. This being said, you will have to make sure the DLL class methods return data types that PHP understands (mostly strings, ints, booleans, etc). In case your methods needs to return an array list or a more complicated structure, you might want to consider JSON for encoding.

Wrapping it up

We’ve found out that PHP offers quite an elegant way to handle .NET specific DLLs. You only need to pay a little attention to “instantiate” them in a proper way. However you might be wondering where this stuff will be needed in your projects, right ? Below are two examples, in fact use cases, that we’ve met with our projects.

Reusing or encapsulating business logic

You may find this approach useful in cases where the business logic is encapsulated in a .NET component but you need to use it from PHP too. Here you just load the DLL class and your good to go as opposed of doing them in PHP again.

WCF webservices authentication

It can also serve as an approach of consuming WCF webservices with WSHttpBinding stack enabled, backed by Windows authentication method. While this kind of service has one or two implementations in PHP, they are difficult to setup which could make the DOTNET class & DLL combo a viable alternative.

Zitec old logo

Why now?

The Zitec logo was created in 2003. It’s old. Period. It doesn’t meet the current needs anymore. It’s not web 2.0 enough. It’s not up to today’s graphical standards. It can’t deliver our corporate message anymore.

The goal

The new brand image should reinforce the excellence of our products and services. We are the best company out there that creates web apps. The new brand image should be new and fresh, distinctive and original, timeless and memorable. It should inspire trust, quality and admiration. Our goal was to create a new, powerful logo that accurately communicates our mission.

Sketches and colors

A good logo redesign takes time and coffee. Our entire creative team brainstormed hours, days even. They started from scratch with an empty sheet of paper and lots of ideas. We definitely needed to change the old company colors. The Pantone 2945 CVC blue and Pantone 021 CVC Orange simply didn’t reflect anymore our growing business and quality of our service. Colors have a language of their own so it’s worthwhile to define the colors that send the right message to our customers. After extensive research, with our target market in mind we came to the conclusions that the best color scheme should contain a new and very powerful shade of orange, called Tangerine (color of the year) and the same blue!

The new logo needed to be abstract and specific in the same time, classy and modern. We had to design our own unique font to accomplish our purposes. Any commercial font, no matter how original and expensive might be, would simply not do. We had to hand-craft the font very carefully to efficiently communicate our future-proof services and solutions.

Some early explorations and sketches:

The creation of our new logo took several long days and sleepless nights but the results are more than satisfactory. Feel free to share your thoughts  in the comments below, all feedback is appreciated although we clearly expect only positive feedback. Let’s not be modest here, the new logo is simply awesome.

And here it is the final logo:

I would start by stating that the current article does not underline any vulnerability with the SSL protocol itself, but it shows how can a person be induced into error despite the high level of confidence and comfort that SSL provides.

This type of exploit is known as Man In The Middle (shortly MITM) which is a form of eavesdropper attack. Although this type of exploit is mostly (and sometimes only) associated to plain non-secured connections like HTTP, it can be employed to HTTPS connections as well.

Below I will present the two most common techniques of running such an attack. While there are other methods to conduct a MITM attack, the two below are the easily camouflaged to user and they require no “intervention” on his/her computer.

These two procedures run with the following assumptions:

1. the attacker has access to your network router
2. the user ignores the lack of HTTPS in the browser navigation bar and/or accepts an invalid server certificate
3. the SSL setup works with server certificates only

HTTP mapping

This method was documented by Moxie Marlinspike (a security researcher and hacker) on his blog. It all started from the fact that most of the times a SSL session is not initiated directly by the user. Instead, a user is redirected to secure page from a main page or login button on a non-secure page. The trick here is to take control of the SSL session before it even starts.

That being said, Moxie created a tool called SSLstrip which should be deployed on the router, server, machine, middleware you want to control. Once configured, the tool will stop all the incoming HTTPS traffic from client and it will initiate the SSL session from here. The client, at his turn, will see only HTTP pages. So SSL strip will securiley communicate with the server and talk back to client on plain HTTP. As far as the server is concerned, the HTTPS connection is fulfilled and the client still gets his content on the page. So both parties are satisfied. The only thing changed here that might be noticed by the client is the HTTP connection instead of HTTPS.

The process follows these steps:

1. client asks a HTTPS URL
2. SSLstrip gets the URL and forward it to server; so, the client never talks HTTPS with the server
3. the server response is retrieved, parsed (HTTPS HREFs are replaced with HTTP and Location headers follow the same rule) and passed back to client by SSLstrip
4. also a mapping of stripped URLs is being kept; that is when such a link is called (http://site.com/page.html), SSLstrip automatically calls the secure version (https://site.com/page.html)

Certificate replacement

This approach also assumes the attacker controls the middleware like in the above examples. The way it works is that a fake certificate is being generated on the fly (with a tool like OpenSSL) and signed with the attacker’s private key. The fake certificate contains all the information available in the root certificate as  the essential information is taken from the original certificate.

Now, the browsers will issue a security warning but as the certificate seems to be valid – the identification data match the original one – the users are tempted to ignore it.

This scenario involves the following steps:

1. the client calls a HTTPS resource on the server
2. the attacker stops and intercepts it and issue the same request on his behalf; so the SSL session is started between the attacker and the server
3. the attacker prepares a fake certificate
4. the response is taken from the server and sent back to client along with the fake certificate
5. depending on the browser, a SSL security warning will be issued (but only for the first time)
6. if the client ignores the error, then it’s all done: all the requests are proxied through the attacker, that simply passes them along to server and returns the response back to client

What can you do about it ?

Despite the technical and fancy terms that characterize these attacks, there are a few simple things that you can do to avoid them. All you need is a little attention.

• do not ignore the browser security warnings
• pay attention to HTTPS in browser’s navigation bar
• save the banking operations for home as there are little chances for someone to get control of your home router
• and password protected your internet access to your home router (WEP security is available on most of the routers)
• for organizations, make sure to employ the SSL client certificates
• in case your business expose sensitive webservices: make use of message encryption provided by WS-* stack

SSL is a protocol, not a HTTP extension, not a digital certificate nor an encryption method. As it finds itself at the TCP layer it can be employed for other application protocols than HTTP (i.e FTP, SMTP, etc). SSL is the predecessor of  Transport Layer Security (TSL) and although they do the same thing – until a certain point – the former definition is much popular among the developers. TSL has a few enhancements compared to SSL when it comes to client’s and server’s ability to specify which hash algorithms to use, sha-256 for pseudo random function, etc.

SSL protocol enforces 3 aspects of  client-server communication:

1. authentication – both one-way (server authenticates to client) and two-way (client authenticates to server as well)
2. privacy – which is message encryption
3. message integrity – by using MACs to make sure the message content hasn’t changed during transmission

Certificates

The certificates are at the base of SSL protocol as they encapsulate the vital information needed for this protocol to work. The most important information in a certificate are: the certificate issuer, the identified entity, validity dates, the public key and the algorithms used to create the signature and public key.

Simply put the main roles of a certificate are to guarantee that the entity presenting it, is the entity claiming to be (that is a valid CA signing the certificate) and to generate the “master secret” needed for the symmetric data encryption.

CA

CA comes from Certificate Authority which is an entity that issues digital certificates. Every browser out there has a predefined list of CAs that come along. Everytime a SSL session is initiated with a server, the root CA of the certificate is verified against the local list of CAs. Whenever an issuer is not on that list, the browsers pops up a security warning, usually in a dedicated page.

Server certificates

This the most common deployment form of certificates today and it employs an one-way authentication mechanism.  This assures the client that the server is who pretends to be by providing it a digital certificate. The client checks the CA that signed the digital certificate against the local CAs list.  The detailed procedure used to establish the SSL session is detailed below in Handshake section.

The diagram below (taken from HP site) depicts the server certificate check.

With this approach the client is not authenticated to server, so the server has no guarantee that the client is who pretends to be from the SSL protocol perspective. Application level authentication is out of the question here.

Server certificates are heavily used by social networks, public webmails, intranet portals and so on.

Client certificates

Client certificates leverage the full power of SSL protocol by employing the two-way authentication model. Here, not only the server is authenticated to client but the client, at his turn, is authenticated to server. This way both parties are trusted and the identification problem is solved.

This model requires  a certificate to be installed on the client machine (his/her browser most likely). The client certificate is signed with the private key of the issuing server. The client certificate contains both a private and a public key and, exactly like with the server certificates, the public key is sent along with the certificate to the server requesting it. An important thing to note here is that the client certificate is used during the handshake process only, when establishing the SSL session parameters.

Given the fact that each client must install a client certificate to access a server or a service, this model is not easy to scale and that is why it is less popular nowadays.  It is especially used by banking institutions where knowing the identity of both parties is a must.

The diagram below (also from HP site) shows the two-way auth process with client and server certificates.

With client certificates you can easily achieve a two-factor authentication by combining something you have (a digital certificate) with something you know (a password). This could be a good option for the random code generator devices that most of the banking systems uses today.

One downside of client certificates could be in the fact that they are no easily portable. That is once you installed a certificate on a browser, you cannot use it from another work station unless you install it there too.

Handshake

The handshake is that process in which the client and server agree on various parameters to establish the secure SSL session. A detailed description of each step involved in handshaking process can be found in the corresponding wiki article.

The authentication part of the handshake process is encrypted with asymmetric algorithms, while the rest of the SSL session communication is encrypted with symmetric algorithms which are by far much faster.

By default the SSL handshake is performed with every new TCP connection being made to server. That is why the Connection: Keep-Alive header should be used so a TCP session (and therefore a SSL one) to be reused across multiple HTTP requests. By not doing so you will overwhelm  the server in the SSL handshaking process.

Browser support

Any major browser supports at least on TLS version with fail-over to SSL 3. For instance IE8 on Win has TLS 1.2, FF 3 and Chrome have 1.0 and Safari on Mac has on version of TLS (not specified which one though).

Using tools, in general, for automating tedious tasks is an idealistic principle in a perfect world. And why not use them – tools make our lives easier by removing the necessity to perform daunting, repetitive tasks. What seasoned SEO wouldn’t give a small fortune for an all-in-one tool that can do on-page analysis, perform a competition analysis and potentially rank a website with a few clicks  - let alone send an email with a summary to a client, fully automated ? I know I would.

Sadly, such a tool doesn’t exist – at least none that I know of – and if it did, I’m pretty sure it would actually cost a small fortune. Various SEO tools have emerged on the market in the past couple of years,with functionalities ranging from backlink analysis to generating automated white label reports for clients. While I’m not a fan of this large-scale completely impersonal approach, I do reckon that paid SEO tools have an advantage in the industry – they are offering to automate the aforementioned daily tasks, at a reasonable cost.

But why should anyone pay for something that offers a handful to almost no customization options? Why should I be limited to using a couple of template reports, that are also being used by thousands of other people? If I’m paying for a tool, I want to gain full control over it and tweak it to my personal liking. I want to be able to customize the reports, move and remove blocks of irrelevant data from them, possibly graph the data in a more compelling way and also add my personal suggestions at the end of the document.

Advantages of using free SEO tools

The obvious, they’re free and of course the possibility of building upon these tools and enhancing them even further. Recently, SEOmoz published an article on the “ideal rank tracker” and what people expect from such a tool – they’ve listed ten industry tools that all do the same thing, track your rankings across search engines and save your historic data for further analysis. The lowdown – they all fail to deliver what they’re supposed to, in the simplest manner.

Backlink analysis – On the 21st of November, Yahoo’s Site Explorer closed its gates to the public and moved its data to Bing’s Webmaster Tools, completing the move over to Bing. A lot of the SEO tools available on the market that were capable of performing a backlink analysis are merely scrapers – gathering information publicly available, filtering it for duplicates and outputting into a window. One of the best free tools available for backlink analysis was indeed Yahoo’s Site Explorer – but don’t worry, we’ve still got Majestic Tools and Open Site Explorer to get the job done.

Screen-shot of OpenSiteExplorer analysis for techcrunch.com

Sure, there a few missing stats that would are accessible to the “PRO only”, luckily those are the stats you could get for free by writing up your own scrapers, using only free, publicly available APIs. Below is a screen-shot of a dashboard that I’m using for a quick competition analysis – all built using free APIs.

Screen-shot of dashboard built using free tools and publicly available APIs 

Pretty close, right ? The numbers aren’t a perfect match with OpenSiteExplorer because they update their indexes on a time frame basis, so you don’t know exactly when the numbers were crunched last time and how accurate they are. Lastly, but not least, using a free API does have it’s own limitations – as you can see I’m able to retrieve a count of under 1M backlinks for techcrunch.com, whilst the OpenSiteExplorer reports around 1,2M backlinks for that particular URL. At that backlink volume, the difference is nothing to shy about – I got the overall picture, trying to rank for “techcrunch” would be extremely difficult.

Usages of such an SEO Dashboard

• You get a quick overview over a certain keyword – assess the difficulty of the niche, interpret the data and put it into actionable stats.
• You could create your own “difficulty” analysis formula based solely on these raw metrics and incorporate it into your dashboard – for those that know that PageRank is merely an indicator and not a factor.
• You could run it on a cron-job (scheduler) and have it “screenshot” the competition, monitoring it weekly.
• You could graph the data and output it in a presentation for a potential customer – remember, flexibility is power.

How to get started on creating your own SEO Dashboard

For starters you should be able to understand what an API is and how it works, what a JSON encoded response is and how you can parse it easily. If all these things are new to you, performing a simple Google search will give you the required amount of knowledge in a maximum of 30 minutes. We have used Google Docs in this example to take advantage of its flexibile programming interface as well as to make sure we can present the data in a more friendly manner.

Writing a function in Google Docs

If you haven’t already, sign-up for an account on  Google Docs and start harvesting its power. Not many know that Google Docs offers a script editor, a javascript development medium that allows you to use the Spreadsheets as a database and perform automated tasks on them. You can find the Google Docs Script Editor in the Tools -> Script Editor menu.

Your first function in Google Docs

Assuming you have started your Google Docs Script Editor and were presented with a blank workspace – which we will be naming, for the sake of this article, “My SEO Dashboard”. Below is your first function that will fetch the number of shares Facebook reports for a certain specified URL. Write it down into your Google Docs Script Editor and hit the Save button – that’s it, now let’s put it to some good usage.

function fbshares(url)
{
  var jsondata = UrlFetchApp.fetch("http://graph.facebook.com"+url);
  var object = Utilities.jsonParse(jsondata.getContentText());
  return object.shares;
}

How to incorporate your function into an SEO tool

Assuming you will have a set of URLs – maybe the first 50 results from Google for a particular keyword – you would call the function as follows:

iferror(fbshares(A1),"no available data")

Where A1 would be the cell in your Google Docs Spreadsheet that holds the actual URL.

Obviously, the functionality of such a dashboard could be extended to something more complex that returns direct actionable data, the parsing and filtering happening in the back. The purpose of this article was to highlight some of the advantages of building your own free SEO tools as well as to give you a few ideas on how you could easily automate some of the most daunting tasks when it comes to SEO.

What’s different about HotelPeeps?

HotelPeeps has two special features – Price Trends and Special Deals – meant to constantly monitor the evolution on the hotel market and display the attractive variations, as special deals.
Finding better prices than the big guys in this market is happening quite often. Take for example some of the hotels below and their prices for this season.

These offers are available for November, 29th. All prices are subject to availability or change without notice.

Price Trends & Special Deals

One of the main features of HotelPeeps.com is Price Trends – a chart that allows you to keep an eye on some of the most popular destinations and the market trends. By checking the Price Trends for your favourite city, you can actually see when the prices are low or shift departure dates a bit, in order to save up for your next trip.

Moreover, you can check the Special Deals for more then 50 destinations, and save up to 75%! What HotelPeeps.com does is to detect high price variation compared to the hotel market and mark these variations as Special Deal. So basically you get more quality for the same budget.

For example, here’s how the Prague Special Deals look like: http://www.hotelpeeps.com/prague/923 (click on the Show Price Trends button to see the chart).

I know you’re probably dying to check upon your favourite destination, so I’ll just add one more thing: you can find the HotelPeeps site available in English, Russian and Romanian, on Facebook or on Twitter.

Often you come to a point where you need to process data in a non-blocking fashion and in multiple threads at once. A solution for doing this is Gearman that we also used in one of our recent projects.

This specific project contains a collection of RSS feeds (a few thousand items) that need to be permanently pulled by specific rules. Each time new content is detected in a feed, one or more callback URLs need to be fired. A great part of the RSS items have to be checked every 5 minutes.

The first solution and the fastest, would be to set-up a cron to run every 1 minute to scan the items against the time rules and fetch them sequentially. While this approach seems to be the winner it has a couple of drawbacks, out of which I’ll mention these two:

1. If one of the feeds gets into a network congestion the script will block, a new one will be started a minute later (by the cron tab) and you will end-up with a lot of zombie PHP processes
2. Scaling. With a single script that checks each feed at a time, you cannot scale.

So, we went to Gearman.

But what is Gearman ?

Gearman is a framework that provides parallel data processing and load balancing between processes. It comes with implementations for various programming languages, including PHP. Gearman operates with 3 basic concepts:

1. The Client – the part where the processing requests are issued – this can be a PHP script for instance
2. The Job Server – this is where the magic happens: it receives requests from clients and dispatch them to registered workers in a load balanced fashion
3. The Worker – the part of the system that actually process a job – one or more PHP scripts

Putting it all together

Back to our project. We have the RSS feeds stored in a MySQL table. Each feed has a time rule when it needs to be pulled. A cron runs every 5 minutes and decides what feeds need to be pulled.

The feeds that need to fetched are sent one by one to the job server in a non-blocking manner. This way you achieve a better throughput than having the cron to check the feed. Below is is the client part of the Gearman:

$feeds = new Feeds();
//retrieve the feeds from the table
$feeds_list = $feeds->getAllForUpdate();
 
// set-up the client by connecting to a server
$client = new GearmanClient();
$client->addServer(GEARMAN_SERVER, GEARMAN_PORT);
foreach($feeds_list as $feed_info) {
   $client->addTaskBackground('process_feed', serialize($feed_info));
}
$client->runTasks();

The worker script is daemonized with SupervisorD. SupevisorD is a process control system that takes care of maintaining the desired number of processes for a given script, in our case the worker. A good practice is to start as many worker scripts as the number of processor cores available on the system.

This is how we’ve configured SupervisorD to meet our needs:

[program:feedworker]
process_name=%(process_num)s
command=php worker.php
numprocs=12
directory=/var/local/gearman
autostart=true
autorestart=true

The worker script that actually handles the feed processing looks like this:

$worker = new GearmanWorker();
$worker->addServer();
 
// Register the same function we invoked on the client
$worker->addFunction("process_feed", function ($_job) {
	$data = unserialize($_job->workload());
	// delegate to a specialized class to process the feed
	$feed = FeedProcessor($data);
	$feed->work();
});
 
// keep an infinite loop so the script won't die
while(true) {
	$worker->work();
}

The set-up

Our current set-up, which runs on AWS, consists in a machine that runs the  client script and the Gearman server and another machine that runs the worker scripts. The worker scripts machine is part of a scalable set-up so the system can automatically spin up more machines when the processing demand increase.

Before adding Gearman to our set-up we were able to process ~52 feeds/minute with a single php script. The things totally changed with Gearman when we achieved a ~154 feeds/minute processing ratio. Both the single php script and the Gearman workers scripts were tested on the same machine, with the only change that the later was in fact multiplexed in 10 worker processes instead of a single one.