The temporary production site did not have this problem, however, so I synced up the latest secure cookies code and the production site and everything worked as expected in IE. IE is very developer unfriendly for viewing cookies and headers, and I was recommended a tool called Fiddler for debugging the cookies in IE. Upon viewing the cookies in Fiddler, the software itself threw up a warning that read:

!! WARNING !!: Server hostname contains an underscore and this response sets a cookie. Internet Explorer does not permit cookies to be set on hostnames containing underscores. See http://support.microsoft.com/kb/316112.

So I came away from this ordeal with two important lessons:

1. Don't use underscores in your domain names.

And...

2. Fiddler is a very useful tool for debugging headers and cookies for Internet Explorer.

Hopefully someone will read this post and be saved some time. I spent hours troubleshooting this problem, came up empty with a number of searches, and likely would have sunk more time if Fiddler did not alert me to the bug in IE.

Discuss this article »

Mr. Anderson's slide show presentation used some cards from getmentalnotes.com and he gave away sampler packs at the end of the session. They look like a great resource that I'd never heard of prior to this talk.

?Adobe?s Tooling for jQuery and the Mobile Web? was an ok preview of how Dreamweaver and the Flash IDE are being developed to integrate with mobile technologies better. Flash can actually output code that?s not flash now! The talk focused on the tools way too much for my liking, however, as I?m not a fan of either Dreamweaver or Flash.

?Merch: The Other White Meat Of Monetization II? was a good panel to put late in the day, as it seemed relevant for musicians who might be attending both segments of the conference as well. The talk was actually very interesting, covering the effectiveness of selling merchandise by a number of sites including LiveStrong.com, CollegeHumor.com, Despair Inc. and more - so different business models, not just selling a shirt for your site. They covered some of the high level strategies and considerations for merch and social media, as it applies to each of the business models represented. A lot of the focus was on signal and message over the merch itself.

Day five was a strong ending to the interactive conference. Overall, I think it was worthwhile as a way to get caught up with all the hot topics (social, mobile, and the convergence of web, marketing, advertising and games in those areas), although there were a lot of panels that were big on talk and light on actual answers. I met a lot of developers there, but felt that the schedule was pretty light on pure development topics. There were a few workshops that I opted to pass on, however, and I was just as happy with the UX focused talks that are just as important to me in creating quality applications and sites.

The crowds were noticiably thinner throughout the day and that night, with many people opting to leave on Tuesday. Check Metalunderground.com for the reports on SXSW Music, spanning the next five days.

Discuss this article »

?Authentication Fails = ID Thieves Succeed. What?s Next?? was a decent talk that covered many security concerns and ways people have stolen personal information through different technologies, such as unlocked iPhones. There were some interesting password stats from recent data leaks as well. It?s funny that the most common passwords are ?123456? and ?password? still - even at a security firm that was recently hacked. Unbelievable. I was hoping there would be more answers as to the common login scenario on web sites, but alas, there were not - at least none that I hadn?t already heard/put into place (use a salted hash for password storage for the best data security).

?Moving the Web onto Mobile Devices? was another canned panel discussing the practical concerns - in their experiences - with moving or replicating the web experience on mobile devices. It was an ok panel. There were some interesting insights, a lot of talk about the myth of what HTML5 really is, but not a lot of questions answered, once again.

Finally, I hit up ?DIY Diplomacy: Designing Collaborative Gov? to fill my government-related quota for the day. This one was fairly interesting as well, focusing on the Department of State?s efforts to share information better such as in the Virtual Student Foreign Service and Diplopedia projects. It was interesting to hear about some of the efforts and struggles against government culture, but again, I didn?t take away much relevant to my everyday work.

That wrapped up Day 4 of SXSWi.

Discuss this article »

?Death of the Relational Database? was admittedly a sensational title (like many here) by Hank Williams of Kloudshare, but it was one of many talks relating to the newer distributed databases in the cloud. He admitted that relational databases are not dead, but perhaps ?dying? slowly as the newer technologies become more viable and take hold in an area that has been the sole property of relational databases for 30+ years.

SQL is one of my stronger skills, so I thought it would be good to hear where things were heading in this area. Mr. Williams was a good speaker, but I couldn?t get past the many bad analogies that piled up one after another and especially his statement that databases really contained no relationships within themselves - that those were all maintained in the application layer. This is patently wrong for many databases, and bad practice to boot, however. He got my attention back when he spoke of scaling and sharding of data, but never really got into any specifics of these newer technologies than naming a few of the newer cloud database applications, so there were not really any answers to get out of the talk.

It was quite a hike to the Sheraton from the convention center to hear ?UX Research and Web Analytics,? but it was an interesting talk about how usability testing and analytics can both be used in different areas, and how they can be used together to validate each other. The bulk of the talk was around specific case studies that illustrated where just usability testing had led the site astray, how analytics could be used to find usability problems (such as conversion rate anomalies), and how they could be used together.

?Bloggers Fight Back: Legal Workshop for Music Bloggers? was also in the Sheraton, making the long walk more worthwhile. This session was run by a couple of folks from Public Knowledge, including a lawyer, Michael Weinberg and Mehan Jayasuriya. It was an informative session that focused largely on the ?folk copyright? that was perpetuated online and clarified the issues of posting music online for download or streaming (you need permission, and even then, keep an audit trail and make sure the proper decision makers are in the loop).

They also talked about DMCA notices and liability if you?re on a self-hosted platform. Anyone in the latter situation should head to copyright.gov/onlinesp/ and cough up $100something bucks to file that form to cover your ass in case users post illegal download links on your site. Otherwise, you are liable and can have your domain stripped without a DMCA notice, as those are technically meant for hosted platforms such as Blogger.

It was good to get some proper answers from a lawyer and some practical ones from Mehan when Michael had to hedge too much.

?HTML5? The Web?s Dead, Baby? was another sensationalized title. Really? Two ?... is dead? topics in a day? This panel discussion used a statement of this nature by Wired about native mobile apps vs the web as a springboard for discussion by a panel of consultants and two Microsoft folks. The questions were a bit canned like the CSS panel the day before, but it was definitely more interesting than that one. Still, I took not a single note and there were not really any good takeaway points even though it was an interesting discussion. Native vs. web really depends what you want to do.

After heading in to rest up a little and change, I scouted out Emo?s at night, since I would need to know how to get there for SXSW Music - a lot of the metal shows and showcases I want to see will be there. That night they had a ?Beercamp? competition going on. It was fun to watch and cool to be at a bar with all geeks and be able to strike up a conversation with pretty much anyone who didn?t have their face in a mobile device. The club is interesting... It seems a little barren and run down on one hand, but it?s very open and has a certain charm to it. The openness is fantastic for getting some fresh air and not feeling and smelling like you were stuck in a smoke box.

There was DJing in the ?Beercamp? area and some decent, catchy alt-rock up front. Once the couple of bands I saw were done, they switched to playing some heavy metal through the sound system, which was cool with me, but that room quickly cleared out. I joked with the bar tender about running everyone out with it (as Slayer was playing) as I finished my free beer.

I walked up and down 6th Street to see what else looked interesting. It was like nothing I?ve ever seen. The closest thing I could compare it to is Georgetown (in Washington, DC), but the strip was longer here and there were 18,000 people here for a conference. There were some pizza places that smelled so tempting, but I resisted. I stopped by Maggie Mae?s for a drink at the bar and then called it a night and caught a shuttle back to the hotel.

Discuss this article »

?How Print Design is the Future of Interaction? was an interesting talk by Microsoft Creative Director Mike Kruzeniski that covered past trends in desktop, web and print design and how we can draw more from the principles of print design going forward.

"Drawing Back the Curtains on CSS Implementation" sounded like something fairly developer-centric, and featured Molly Holzschlag, a big name in the realm of CSS. However, the talk was a dud, coming off as a canned-Q&A that was way to informal and focused on the inner workings and struggles of the working group and product developers as opposed to anything that really applied to developers.

By noon, the Screenburn Arcade Gaming Expo had opened up, showcasing a few dozen booths pertaining gaming sites and services, upcoming games, and even most interesting (to me), an upcoming mobile platform based on JavaScript, Kinoma.

I ran off to the ?Mistakes I Made Building Netflix for the iPhone? session only to find a line of folks waiting to get in, as it was full. So I gladly returned to the Screeenburn Expo and to track down some lunch until the next session.

I felt compelled to go to ?Changing the Web Accessibility Game Plan? due to the mandate of accessibility at my job and the fact that those techniques are generally a good practice. This was more of a discussion, however, with no solid takeaway points. The question was asked if the web as a whole was becoming more accessible and discussion stemmed in many directions from that. Unfortunately the conversation lead to few solid take-away points, or at least nothing to apply to my job as a developer.

The final session I attended was called ?Zombies Must Eat: How Genre Communities Make Money.? It was quite a walk to get there, but it was worth it, especially in the beautiful spring weather. What caught my attention is that it was headed by site owners in the horror movies niche, Skot Leach of Lost Zombies and KW Loww of Dread Central. It focused more on community building than actual monetizing of site traffic, which was fine. The experiences of the presenters were very interesting and mirrors my own in many ways. It was more of a reinforcing discussion than enlightening, but the presenters and subject matter kept it very interesting.

Day two of SXSWi was a mixed bag, with a couple of good talks and a couple not so good, but that?s to be expected at any conference. The good definitely made it worthwhile. Let?s just hope the shuttle issues are resolved tomorrow. Rather than leave it to fate, I expect I?ll just plan on getting up even earlier to beat the rush, despite the loss of an hour of sleep tonight.

Discuss this article »

I arrived in Austin Thursday evening and the interactive and film portions of the conference officially kicked off on Friday, March 11th. With no talks scheduled before 2pm, I figured I?d go pick up my badge and check out the expo/tradeshow area until lunch time.

I got my badge and ?swag bag? and headed off to explore the massive Austin Convention center. The swag bag contained only the basics this year: a SXSW pocket schedule and map (essential), the SXSW Interactive book, and the SXSW edition of the Austin Chronicle. It was commented by a few conference goers that it was lighter on swag than in previous years.

The Austin Convention Center is large and a little confusing, but not as massive and I thought. But I also wasn?t expecting the convention to actually span multiple hotels, some several blocks away.

Unfortunately, the expo doesn?t open until Monday, the 14th, however, but this left plenty of time to roam the convention center and nearby areas, and even relax in the sunny, warm weather on a small strip of grass in front of the Hilton long enough to get some sun on my face.

The crowd was very noticeably a geek crowd, seemingly very much made up of geeks in their mid twenties to thirties and older. Everyone had some sort of smart phone to play with, and with all the down time we had before the session began, the walls were lined with people consumed with using their mobile devices. Luckily I had my ipod touch and a Wifi connection to search the schedule and interactive map via the excellent SXSW Go app, so I wasn?t entirely out of place among the mobile using geek crowd.

Two o?clock finally rolled around and I went to the ?Big Brother on the Big Screen? panel, featuring Chris Conley (ACLU), Cindy Cohn (EFF), and Tim Edgar (Office of the Director of National Intelligence). It was an interesting discussion about what the government can and can?t do (physically and legally), using fictional movie clips as springboards for discussion. It was an interesting talk, and there were certainly some eye-opening points - such as the description of the fiber optic splitter in the AT&T building in California making a copy of all cell traffic going through there - but far fewer than one might expect, mostly due to Tim?s cagyness about some topics, however reasonable it might be given his position.

The next presentation I attended was ?Location, Location, Location? from Google?s Marissa Mayer. There was nothing else compelling in this time slot, and I figured Google would have some cool stuff to show. And they did. To top it off Marissa was a great speaker. She unveiled some recently released products such as traffic routing, turn-by-turn navigation, Google Maps update to vector-based maps, and even Google Hotpot (local recommendations). Interestingly, Google Maps currently has about 150 million mobile users, comprising about 40% of its traffic. The ways that local and maps have grown is heavily due to mobile usage, and mobile and social themes ran deep throughout most of the sessions offered at SXSWi.

Interestingly, despite the lack of very web developer-centric topics, I met quite a few web developers (in the traditional sense) in my downtime.

Exhaisted and fighting a headache all day, after a quick bite to eat, I headed back to my hotel. Capping the first day, was an extremely long wait during the shuttle service?s shift change, which happened to be around 6pm, which was terrible timing. Not only was it during one of the busiest times when people were heading back to the hotels, but it was during rush hour. So while vans waited for drivers, others were stuck in traffic, slowing service further. I heard from many people that it?s always crazy and uncoordinated on the first day. I hope this is the case.

Overall, Friday seemed like a very optional day. Had I been here before and known my way around the city and the convention center a little, I would have flown in on Friday morning rather than Thursday night. But it is a lot to take in, and having some extra time to do so on your first visit is nice.

Discuss this article »

I ran across it after noticing a small spike in traffic due to a link to my blog noting some issues with Eric Meyer's reset.css and table striping in IE. You can read further discussion of this problem and solutions in my follow-up post.

Discuss this article »

I'm quite happy to see that my blog posts have been helpful to people. My "CSS: Overcoming 'background: transparent' In IE" has been read more than 10,000 times and I've seen it quoted on random forums in response to people encountering this particularly annoying issue with Internet Explorer.

...And then the project from hell hit and I was pressed for time to do anything for six months. Here we are almost a year since my last post.

To be honest, this blog has always taken a back seat to my main site, Metal Underground.com, and it always will. Metalunderground.com is my creative outlet on so many levels and has the potential to grow beyond anything I initially imagined.

That said, I've had more opportunities at work to explore the front end of web development once again as well as work with different frameworks and CMSes. I've got a bunch of draft blog posts built up here and hope to return to exploring and discussing web development from front end to the Coldfusion back end stuff soon.

I'll be back.

Discuss this article »

Wednesday evening I got the confirmation call, which stated the correct time of the appointment for the following day. Late Wednesday night, Internet connectivity was restored, but I didn't trust it (because it had come and gone a few times in a matter of 15 minutes) and still planned for a technician to come out.

On Thursday my connection seemed ok until around lunch time. This would be perfect since the tech was supposed to arrive between 11am and 2pm - and for once, they could actually witness the problem instead of everything mysteriously working during that time...if they actually arrived. At five 'til two, I called Comcast to make sure they were coming, and it turns out they were not. They proceeded to tell me that a technician was out on Wednesday, and then changed the story to "I have no appointment in the system for you." So the lady whose voice is in the confirmation recordings must have called me up personally as an April fools gag, right? The service rep then proceeded to tell me that they have no openings and the earliest appointment they can give me is Sunday! Talking to a "supervisor" made no difference, and I suspected they just did the age old trick of passing the phone to the person next to them, who doesn't give a damn about you or Comcast service either. They are drones and talking to them only reinforced that, as claims of the ridiculousness of the situation and why I have to pay the price (in time wasted/lost) for the screw-up were dismissed in a monotonous droning voice over and over. Meanwhile I will be waiting a full week with mostly no Internet and substandard TV service (it's been breaking up and dropping sound on and off) before anyone will even come out and look at our issues. And chances are that they won't even be able to fix the problem, since my neighbors have been experiencing similar issues as well.

What more could I expect but the usual Craptastic service from Comcast? Don't even get me started on the number of times I was told that if I had upgraded to a business account I would have next-day service. Let's put this into perspective: if I were running a small office on a business account (as it's intended) and had 5-10 people lose a day of work due to a Comcast outage, that would still be unacceptable and I'd be paying much more for the service. There is no way to dress it up - Comcast's service sucks. If they did not have a monopoly in our area, I would drop them in a second - and I plan to the day Verizon gets FIOS service in here.

The bottom line is that - yes, losing Internet access sucks, especially when you telecommute and own a website that you need to maintain - but it's excrutiatingly frustrating when other people's incompetence makes life harder on you. And to top it off, they were unwilling to lift a finger to make things right. If there was any competition, Comcast would be gone. The service that we pay for from Comcast - both TV and Internet - is already obscenely overpriced. The customer service that they provide is a disgrace and completely unacceptable even if the service was free. To top it off, no one is accountable. If they were even accountable for their actions or serving customers, then the drone-like attitudes would be gone. In retrospect, it's pretty clear they don't care about a damn thing from "Hello." I guess I should have seen the rest coming then.

Comcast is a dinosaur that has long outlasted its time and deserves to be extinct. The more I read about Comcast's strong arm lobbying tactics as well as other underhanded tactics used in court, the more I realize that's the only reason they are still around - they spend all their effort protecting their monopoly, not pleasing their customers or tending to their network.

Discuss this article »

• On-page optimization: was most important in the early days of search (along with meta-tags) but has waned in importance over the years as other factors for ranking have been introduced. However, on-page optimization is still central to any SEO strategy, especially for long-tail searches (the abundance of lower competition search phrases and their frequency of searches based on power laws), as noted here.


• Link Building: Google made the link the currency of the web by factoring it so heavily into their pagerank algorithm. After link buying became widespread via link brokers, paid reviews and paid directories, Google has steadily reduced the importance of links alone. Links are still an indication of authority, however, and quality and diversity of links and link text are still important trust/authority indicators, moreso than just total number of backlinks.


• Trust/Authority Ranking?: Factors to validate a site's authority, such as who links to them, age of the domain, and temporal analysis of content creation and link building are thought to be weighed more heavily now, making social marketing a very effective marketing and SEO strategy currently.

Start with the basics and make sure you're doing things right for on-page optimization. On-page optimization alone will not earn you great rankings for any competitive keywords, but doing it properly means that you're not handicapping yourself down the road, and it can get you ranked for some low-competition long-tail phrases that accumulate over time to become a significant source of traffic. On-page optimization also cascades over to your link building campaign, since poorly crafted titles or headings can sabotage your efforts to build quality links from social media and other bloggers. On-page optimization is often overlooked these days, as it is not the controlling factor to get ranked on the search engines, but it is, in fact, an important foundation that should not be overlooked or neglected. On-page optimization should not drive content creation to the detriment of making content interesting for human consumption, but should be applied in an intelligent manner to make content work best for both humans and search engines.

On-Page Optimization Basics:

1. Domain name*. It's debatable, and may also depend on the type of site or service you are planning. Some will say a brandable domain name is more important than a keyword-filled name, but if you can get both at once, it will help your SEO campaign a lot in the long run, and can give it a definite boost in the early days of the site as well.
2. Title. The page's title is probably the single most important on-page factor to ranking well for search terms. Here are some tips on how to optimize your page titles:
   • Home page: Domain Name + tagline (designed to contain more relevant keywords) - E.g. "Sitename.com - your tagline here"
   • Content/Article Pages: Short Title + Site Name (if branding is desired or relevant keywords in site name) - E.g. "This is the article title (Sitename.com)"
   • If your site URL contains multiple words without dashes, separate them with a space for display. This lets them be recognized as separate words by the search engines.
3. Tagline. Place a well crafted tagline just under your site logo. Even if the tagline is plain text (not a heading, strong, emphasized, etc.), it seems to carry much weight in the proximity of your H1 tag and so high in the page's source. This tagline should also be used in the title of the home page. I have seen interesting search results where sites rank for various combinations of high-competition keyword phrases over time just because the tagline included a couple of important keywords that were not usually included verbatim in much of my other content.
4. Heading Tags
   • H1 may be your site name if it includes relevant keywords (then use H2 for the full article title)
   • H1 may be used for your main article title if the site name is not of significant SEO value.
   • Use subheadings (h2,h3,h4) for secondary groupings and to break up long articles into readable chunks. These heading tags all carry some additional SEO value over plain text or faux headings marked up with bold or strong tags or CSS alone.
5. Use CSS and image replacement techniques for design/page template elements to allow for proper structural (SEO friendly) markup of text, rather than using images directly in your HTML. E.g. The difference between using an H1 tag for your site logo vs an IMG tag could be significant.
6. Use a long headline and short headline/title for articles throughout your site. Small variations make the site look less search engine optimized, while creating slight variations in keywords used and targeted. In looking less intentionally optimized, having a differing title tag and article heading (h1 or h2, as the case may be) is the most important. The SEO value of a page title is high, but only up to around 160 characters. Using a separate, longer article headline allows you to fit some more important details in there while also making it differ from the exact title (short headline). Furthermore, you can vary where these two headlines are used as links: Use the full headline in RSS feeds, which often are auto-linked when displayed on other sites and feed readers. Use the short headline throughout your site to inter-link content via the main blog page and lists of popular and related articles. The short headline is also idea for creating URL slugs for search engine safe URLs.
7. Site architecture and friendly (Search Engine Safe) URLs. Naming subdirectories and pages using useful terminology (keywords) and SES URLs can have some impact on search rankings, as the URL is seen as a factor as well. Using SES URLs may not make or break an established site in search rankings, but can help an startup get more content indexed, as it has been said that Google's limits to how much dynamic content it will spider scale with the site's PageRank.
8. Meta-Description. Create a Meta-description tag for each page. For articles, this can be done by using the long headline or another field such as a summary. The Meta-description arguably may play little to no role in actual search rankings, but is often what is shown in the search engine results pages (SERPs) and then can make the difference between a click through to your site.
9. Inter-link related content. This helps people as well as search engines. Links from your own site are not worth as much in the eyes of the search engines as links from external sources, but linking related content on your own site can help the search engines makes sense of it (using both the link text and subject matter of the page linking to the content) as well as help search engines find your site's early content that may not have been indexed properly when the site was younger. A related articles list may be sufficient, but editorial/in-content links are typically seen as the best location for links, and this may be true for same-site links as well.
10. Diversify. Building and getting links that are diverse looks more natural and may help you more in the long run that a tightly controlled effort to target one or two phrases over and over. Diversifying the places where your content or keywords live may also help to some degree. Having a phrase as the alt-tag of an image may be helpful, as well as emphasised, strong or link text (but don't try to do them all, all the time or you'll ). After these points, you enter the realm of diminishing returns.
11. Further optimization may not be useful beyond these items above. The importance of keyword density has largely been dismissed in recent years and spending too much time on on-page optimization beyond these points or on the later points should probably be spent on content creation or other marketing efforts.

A good CMS will be able to accommodate many of these points out of the box. Some do not and many may require some customizing to get it right, however, which is why on-site optimization is important to get right from the start.

Keyword Research

Content Creation For People

Conclusion

Further Reading

• Google's SEO Starter Guide
• The Long Tail
• Anatomy of the Long Tail
• The Long Tail Demonstration
• Building SEO Momentum by Using A Consistent Site Structure
• SEOBook.com - I've been reading about SEO for many years, but Aaron's blog and (now discontinued) ebook have been an invaluable source of SEO information. Since changing focus, his blog has been regularly producing in-depth articles on various SEO, SEM, and web publishing topics.

Discuss this article »

Now my spam folder is thousands of messages large, so it's not really a good use of time to go through them all looking for false positives, but I'll have to sample the last few days at least.

Conspiracy threories aside (I've never bought into any of the Google conspiracy theories I've heard), the question that has to be asked is at what point does a free service like this become a liability to your busniness? It's definitely made me think twice about hosting any more domain email accounts with them.

I just thought I'd warn some of you about my experience and I'd be interested in hearing if you've experience the same issue lately.

Discuss this article »

content is king but marketing is queen and the queen runs the household.

I really like this and I obviously could not have said it better. This statement concisely summarizes what I was trying to say in my recent post, entitled "Debunking The 'Build It And They Will Come' Myth For Websites, and Is Content Really King?."

In non-analogy terms, content creation alone is usually not enough to create a hugely successful blog or web site, and the content you do create should be part of and integrate with your SEO and marketing efforts. Marketing is usually what really puts a site over the top in success. Sometimes the marketing and content are one in the same (e.g. linkbait, controversial articles, viral content) and other times the marketing is totally separate.

Gary Vaynerchuk Blog World Expo Keynote Speech from David Peralty on Vimeo.

Discuss this article »

remind you of this?:

Oh wait, I just noticed someone actually posted the latter as a response to the former on YouTube, so I guess it's not just me.

I really don't care for politics on any level, but Palin sure isn't doing her party any favors with a number of comments I've heard.

P.S. 45 minutes of tonight's debate is about all I could take.

Discuss this article »

Latency matters. Amazon found every 100ms of latency cost them 1% in sales. Google found an extra .5 seconds in search page generation time dropped traffic by 20%. A broker could lose $4 million in revenues per millisecond if their electronic trading platform is 5 milliseconds behind the competition.

That will get your attention. I think the quote itself confuses the matter of latency with load time, and one must wonder how perceived load time of partial page rendering fits into the equation as well.

The article goes on to define latency and touch on a number of related topics and links to articles that go more in depth on various facets.

Many of these points are related to and boil down to Yahoo's Best Practices for Speeding Up Your Web Site, of which they've added another 20 to the original set of 14.

The original 14 rules were:

1. Make fewer HTTP requests
2. Use a CDN
3. Add an Expires header
4. Gzip components
5. Put CSS at the top
6. Move JS to the bottom
7. Avoid CSS expressions
8. Make JS and CSS external
9. Reduce DNS lookups
10 Minify JS
11. Avoid redirects
12. Remove duplicate scripts
13. Turn off ETags
14. Make AJAX cacheable and small

The additional recommendations are:

1. Flush the buffer early [server]
2. Use GET for AJAX requests [server]
3. Post-load components [content]
4. Preload components [content]
5. Reduce the number of DOM elements [content]
6. Split components across domains [content]
7. Minimize the number of iframes [content]
8. No 404s [content]
9. Reduce cookie size [cookie]
10. Use cookie-free domains for components [cookie]
11. Minimize DOM access [javascript]
12. Develop smart event handlers [javascript]
13. Choose <link> over @import [css]
14. Avoid filters [css]
15. Optimize images [images]
16. Optimize CSS sprites [images]
17. Don't scale images in HTML [images]
18. Make favicon.ico small and cacheable [images]
19. Keep components under 25K [mobile]
20. Pack components into a multipart document [mobile]

This link summarizes them all.

There are definitely some interesting items in there that not everyone thinks about. Including your favicon.ico in your caching plan is something many people might not think about (if you even HAVE a caching plan). Avoiding @import and filters in CSS are certainly things one would not think would affect site performance.

I've actually used <CFFLUSH> in an app or two to improve perceived load time - and it did considerably - but that was in a non-gzipped environment. I've been a bit wary about combining the two, but I may be worrying for nothing.

IMO, the biggest bang for your buck can come from grouping a number of these related items together: split up external assets onto multiple hosts (images, scripts, and css subdomains), serve some from a CDN, and do NOT use domain cookies. That should give any site a serious boost, as it takes advantage of request concurrency while reducing the overhead of cookie requests on potentially a large number of http calls.

It sounds like a lot of stuff to remember or a lot of items to actually do, but these are things best integrated into a best practices list and kept in the back of your mind going forward on new projects. Unless you might be leaving money on the table on existing sites, that is.

Discuss this article »

UPDATE: John Allsopp just published an extrensive summary of the state of font technologies (via Ajaxian).

Discuss this article »

If I wasn't so busy of late, I'd have noticed the many blog posts about SQL Injection attacks hitting ColdFusion sites.
It seems a similar attack swept through MySQL-powered sites earlier in the year, but the recent bout of attacks affecting ColdFusion sites using MS SQL Server hit hard in July with a few as early as June from what I have read. There's a particularly nasty version of the attack (seemingly largely perpetrated by a botnet)
that appends a cross-site scripting exploit (XSS) into EVERY varchar, nvarchar, text and ntext column in your database. Doing so not only corrupts your data, but can result in data loss beyond cleanup.

Fortunately, the attack on Metalunderground.com appears to be more targeted. The attacker injected a 24KB payload of XSS and spam links into each of nearly 40,000 news records. The focus of the injection actually made finding the problem very difficult.

To reiterate what's been said around the Coldfusion development community, absolutely make sure you use CFQUERYPARAM on EVERY variable going into your queries - especially URL, FORM, SESSION and COOKIE and CGI variables, which can all be corrupted. You might as well just make it standard practice, because often variables in the local, request, or other scopes are often dumped from cookies or sessions as well (in application code, that is), meaning any tampering could trickle down into those scopes.

Also, do not rely on the CFADMIN checkbox for "Global script protection" or any other built-in security. I've always been very skeptical of the built-in protection in ColdFusion or any other black-box code like this, and for good reason. This particular attack uses a DECLARE statement and encoded SQL and payload, failing to trigger the catch-words to invoke the protection.

Read on to learn from my experience gained from this attack.

Troubleshooting the Issue

I first noticed something was wrong when I got a down-notice from my server monitor, Pingdom one day near the end of July around the end of the work day. I could still remote into my server, but web pages were not being served. The issue seemed very weird and I began troubleshooting all sorts of stuff from Apache to ColdFusion and the JVM. Sifting through logs, I saw lots of timeouts from CF and eventually reinstalled CF to no avail.

After extensive troubleshooting and research online, I was convinced I was under a Denial of Service attack. As soon as I would start up the server, the TCP connections would queue up at a rate of 5-10 per second. At about 700-800 TCP connections, the server would hang and/or boot me off of my remote connection, requiring a hard reboot to connect again.

A few days went by and I had made little progress after tons more reading. Finally, I noticed that my database files were massive, sitting at 2.6GB. I knew they were only a few hundred megabytes not too long ago, and that's when I started looking more closely and discovered that it was the database that was attacked.

Backup Your Data...AND Verify It!

At this point I went to check out my backups, only to realize they had not been firing for a couple of weeks. And the ones that were firing before that were timing out for some reason and contained only partial backups, never getting to my database that was affected. I pretty much shit a brick, thinking I had lost a ton of data back to late May, when my last good backup was from.

SQL To The Rescue?

After much research, I found a number of stored procs and queries to help me track down the injected text. I wrote a script to clean out the affected table in ColdFusion. All seemed well - the data could be scrubbed, only ntext fields were affected (in my case), it was unlikely that there was any data truncation, and I could close the security holes in my code and be up and running again.

I did this, but the database's file size did not change, even after shrinking it multiple times and trying all the options to shrink it. I started the server up again but its performance was still severely degraded. After more research, I found a neat query that displays the physical size of every table in a database.

SQL: Dead and Bloated

The news table that was attacked still had a gigabyte of empty space in it and there was no way I knew of to fix it. This was presumably the cause for the performance degradation, especially since news is the main feature of Metalunderground.com.

Fortunately, I located a backup of the database I had made manually just a day before the attack. I would lose a little data, but not much by restoring that, so that's what I did. The .mdf file was a mere 360MB for over seven years' worth of data, as opposed to 2.6GB.

Plugging the Holes with CFQUERYPARAM

In my early days as a CF developer, I did not use CFQUERYPARAM. The code base for Metalunderground.com is largely over 8 years old. The main barriers to using CFQUERYPARAM are remembering how the data types map (I still don't remember when to use date and timestamp sometimes) and dealing with NULLs and data constraints. These issues are fairly trivial once you go down that road though. CFQUERYPARAM is a necessity these days. Learn to deal with this slightly less friendly tag or you will be dealing with SQL Injection attacks at some point.

I had actually updated a good bit of my code recently, and using CFQUERYPARAM was a major priority. But there were probably one or two spots where I still did not use CFQUERYPARAM and that's all it took to leave a loophole open. The main place was on a dynamic ORDER BY clause, because you cannot parameterize those values. The real solution to that case is to validate the data more strictly. Since you are likely passing a alphanumeric tablename and "ASC" or "DESC," validation of the data is fairly straight forward.

Pete Freitag has a great writeup on CFQUERYPARAM and how to validate the data in those places where CFQUERYPARAM cannot be used. Additionally, RIA Forge has a project to scan your codebase for queries using variables without CFQUERYPARAM. It can give an enormous number of false positives because it will display every query that has hash signs that are not in a CFQUERYPARAM - even those properly validated, in places where CFQUERYPARAM doesn't work, or even commented out! But false positives are better than missing one and leaving a security hole, so I'd say it's worth the time to check out anyway.

It Can Happen To You!

Don't think because you're a small blog that you won't get attacked. Many blogs have been attacked. Remember that those tools used to scan for vulnerabilities can be automated by hackers to check for vulnerable sites as well. No one is safe, unless your application is airtight.

Further Reading

• Recover from a SQL Injection Attack on SQL Server (MSSQLTips.com)


• SQL Server Find and Replace Values in All Tables and All Text Columns (MSSQLTips.com)

Discuss this article »

Thanks for your patience.

Discuss this article »

As a developer, I've had bad experiences with marketing and sales people. They have been the ones who make promises, whether related to features or delivery deadlines, that the developer has to deliver. Often, they don't even have a clue about the technical aspects of a project and are often talking out of their ass. Not to mention these people just seem to talk too much for an introverted developer's (such as myself) taste. So perhaps I ignored those skills and marketing and sales as a whole for some time as a result.

But as a freelancer or web entreprenuer, there's really no choice but to learn how to market - market yourself, your services, your products, your web properties, etc.

The Fallacy of "Build It And They Will Come"

I've had the chance to get on my soap box a number of times lately to debunk the myth of "build it and they will come." Unfortunately the mantra "Content is King" seems to propagate this myth to some effect.

"Build It And They Will Come" is a developer's (and entreprenuer's) dream, but sadly it is not reality. With millions of sites and URLs on the web, people have to be able to find you and your product. Build it and no one comes. Market it and they will come.

If Content Is King, He's Nothing Without His Heralds

My reading has ranged from books and blogs on freelancing to Aaron Wall's SEO Book, to the Teaching Sells program, and I've realized that marketing is important on so many levels. These included advertising, presentation, niche-focus, sales tactics and copyrighting among others.

Thanks to Aaron's SEO Book (a 350 page e-book that has been discontinued in favor of the Teaching Sells model memebership site that he is making bank off of) I've seen SEO in a new light. SEO is a part of SEM, not a separate task. If you've researched your niche and topic, writing blog posts can be a very effective marketing tool. However, uneducated and untargetted blogging will usually yield minimal results, as many a struggling blogger can atest.

But content is only one facet of SEO. Your link building campaign has far greater weight and an exponential effect on the visibility your site may obtain. Link building involves a variety of tasks, including tapping into directories, the blogoshphere (oh, how I hate how that word sounds), social networks/media and other techniques such as linkbait and viral ads and video. Content plays a role in several of these facets as well, however.

Teaching Sells is a program by Brian Clark (also of Copyblogger notoriety) that I got turned on to via my Problogging reading. It focuses on building and making money with membership websites. The exact model may not be for everyone, but almost any site can feasibly have a membership component. I signed up for a $1, 1 week trial, planning to download some stuff and read it, and cancel before the heftier fees kicked in. However, in my trial, I realized not only what a great marketer Brian Clark was, but that he had a wealth of great content on many facets of marketing such as copywriting, pricing, and more. Furthermore, he made it so I couldn't download much of it, thereby sucking me into his membership program at least temporarily. I have to commend him not only on the superb job of marketing the product, but the quality of the materials inside pertaining to marketing such a product - after all the marketing and sales copy/pitch, I was still impressed with the product and it's presentation. (Note, he is relaunching the system under a new, higher pricing structure on August 1, so check it out now if it sounds interesting).

No Marketing Plan Is Still A Marketing Plan

Even if you've chosen not to market your site or product, you have chosen a course of action. Sure it happens sometimes - if a product happens to take off without any outward marketing plan, it will likely be because of word or mouth or social media and/or networking. Mostly likely such a plan was seeded in the first place. But even in the event that it wasn't intended, not nurturing such successful marketing routes is just plain dumb.

Content Is An Essential Part of Marketing

Let's not shortchange content's role though. The word has come up countless times in my talk of marketting up to this point. Content is still a large part of your marketing effort, both in SEO and copy writing. Perhaps its title is well-deserved afterall. Content is essential for getting the attention as well as closing the sale. Content is often the main attraction as well as a key part of the marketing material.

Let's just be realistic and not fool ourselves into thinking that throwing up a bunch of blog posts and products in a store will bring one riches. You still have to build a quality product and/or write quality blog posts, but you need to market them like hell to ever have a chance of reaching the critical mass needed for success.

Discuss this article »

The person on the phone who set this up did not elaborate any further than confirm that I would have to listen to a sales pitch. I had no idea what the company did, but assumed that they were a service company.

Kirby Sells VERY Expensive Vacuum Cleaners

The experience wasn't horrible at first or I would have kicked the sales people out early on. The lengthy product demo bordering on two hours long could have been shorter though. They spent way too much time interchanging parts to show all the great features of this unit that was much more than a vacuum cleaner. There was so much part switching that I found it to be tiresome and actually a down-side before he was even on to the vacuum cleaner itself. Furthermore, they went on ad nauseum about dust, dust mites and allergens, which I already knew because my oldest son has dust allergies. Mentioning this only made things worse for the sales pitch, however, as the pitch began taking on overtones of guilt. If I could have a cleaner house for my son, I should do everything I can to that end, right?

A Poorly Thought Out Product Demo

They were finally done wasting my time, or so I thought, and they went on to shampoo the carpet. I patiently heard the few minutes demo part and went to get my long overdue lunch.

Bad To Worse Prospective Customer Experience

Simply put, I don't respond to emotional blackmail and I was fed up with it.

By the end of the demo and sales pitch, one would think that you are sleeping in a vat of feces (dust mite feces, of course), and should feel ashamed for letting your kids live in such filth and squalor. I even overheard the lady comment to the demoer, "were you vacuuming outside" as they were cleaning up some of the filter pads with dirt and salt on them. If they were not already cleaning up and on their way out, I would surely have thrown them out then.

The End Result Made No One Happy

Backtracking a bit, the guy who first entered my house and introduced the younger guys who would be demoing the product seemed down to earth and commented that even if I didn't want to buy anything today, they were trying to spread the word and hopefully the demo and service would help me remember the Kirby brand.

However, the end result is that I now know and will not easily forget the Kirby name, but I would not buy a Kirby or recommend anyone even listening to their sales pitch...unless you really have nothing better to do with your time. If that's the case you can come over and shampoo my carpets and I'll even pay you!

And to think they wanted me to buy TWO $1600 vacuum cleaners, which were they were actually able to sell me for the great sale price of $1500! If I knew that before this all began, they would have never set foot in my house, even with a promise of a free carpet shampoo.

Discuss this article »

Who Does The Book Target?

The book states in the opening paragraphs that:

This kit is intended for those who have little or no previous experience with building profit-making web sites.

Starting up a site with little or no experience takes time to build readership and revenue, so a $150-200 investment on top of the other investments that need to be made is nothing to sneeze at.

I was not impressed a bit by the sample chapters. Maybe it's because I've been reading Problogger.net for well over five years now. Problogger.net's content is free and covers every aspect of getting a site operational to marketing it, growing readership, monetizing it, etc. For those who haven't been reading it for the past five years or more, Darren has even released a book that covers each of these topics, and it's under $20 at Amazon.com.

Problogger.net Has All The Free Info You Need

Discuss this article »

Over the past couple of years I've been refining my process for creating site layouts and modular CSS. During that time, most of the refactoring involved has been reworking parts of the markup to be more modular or to use markup that meets my (now) more strict semantic requirements (than when I first started using CSS) and provides all of the hooks for the techniques I may want to apply with CSS. I'm still refining some smaller things here and there, as I discover new techniques.

I recently returned to working on the application that I did my very first table-less CSS layout on, and looking at the markup, I can see what a difference semantic markup makes!

I've been using CSS since 1998 (more heavily in 1999), but didn't really know the best practices in markup until the last few years, making my initial efforts at CSS layouts frustrating attempts of trial and error - not unlike the experience of using CSS in Netscape 4! I actually abandoned my first attempt at redesigning Metalunderground.com in CSS because the layout was too complex for me to pull off. I finally opted for a wrapper table and minimally nested table layout. (Note: Metalunderground.com has since been redesigned twice, first using CSS and then a recent underlying code cleanup, which helped immensely for general coding and CSS-specific techniques).

As many developers and designers can attest, learning CSS itself isn't as hard as knowing which techniques to use in various scenarios, the drawbacks to certain techniques, and how to work around browser-related bugs. Some techniques such as floats versus absolute positioning are purely CSS, but a number of other techniques are based on how you've chosen to mark up your document.

Compound that with the sad truth that many web designers and developers - even experienced ones - don't really know proper HTML or XHTML, much less the best practices of semantic markup, and you can see why CSS still appears difficult after all these years. I was in the same position about five years ago, having used CSS for several years, but still struggling with CSS layout due to not using the best practices for the underlying markup or knowing the proper techniques to use.

So why is it that many developers don't know proper HTML or XHTML? I've encountered all sorts of reasons for this - legitamate and not - over the years. Here are some of the reason that web developers and designers may not know basic proper (X)HTML markup and therefore may have trouble with CSS layout:

• Learned HTML in the "early days" (HTML 3.2 or earlier) and never refreshed their knowledge of HTML 4 or XHTML, semantic markup, or doctypes for that matter.
• Self-taught HTML during the IE years and never really learned how to do it right because IE will render any old slop. Probably cursed Netscape 4 for breaking their pages when forgetting to close a td tag.
• Concentrates on backend programming and doesn't really bother with strict markup for the front-end.
• Sees no benefit to XHTML or strict HTML.
• Doesn't deal with the front-end display and CSS, and therefore never needed to learn about semantic markup.
• Not really into the whole developer thing and just gets by doing what they are doing, creating web sites and applications, without trying to learn or integrate best practices.

It might sound harsh to say that a developer "doesn't even know HTML." After all, HTML is the foundation of the web for the past 12+ years. But I think it's pretty realistic to say that we all know a number of these types of people described above and they account for a large portion of developers. Granted, not everyone needs to know strict HTML, but in my 10+ years in the industry and seven jobs, I've never worked for a company that has a dedicated HTML person write all HTML or clean up what the "programmers" have written after the fact.

With invalid markup, all sorts of cross-browser issues can surface. Without knowing about semantic markup - using markup that fits the meaning or type of data rather than its desired presentation - developers may find themselves in div-hell, much like nested-table hell of yesteryear, if not completely baffled by CSS issues and browser bugs that are more likely to occur with invalide markup.

Without knowing the best way to mark up certain page elements such as navigation, one may be lost as to how to achieve a certain effect in CSS or go down the road of adding additional presentational markup for extra hooks (it's not all bad, but the less non-semantic markup that is added, the better, IMO).

CSS tutorials often tend to focus on the CSS itself and gloss over the underlying markup and reasons for using it. There are plenty of older or just plain bad CSS demos that do not follow the principles of modular or semantic code as well, leading developers down the wrong path; most often to div or span-hell and/or class-itis. Cut and paste CSS sites seem barely a step above their JavaScript counterparts - they are both usually pretty bad solutions.

So what was the point of all that? Just to stress to go out there and refresh your knowledge of HTML. I remember being surprised to learn about a number of HTML 4 elements and their effects in the browser some time back, and there are still people who don't know what a <label> is or have never used a <caption>, <thead> or <tbody> much less <colgroup> and <col> tags in a table. Almost all of these lesser known tags are essential hooks in styling semantic markup with CSS and key to modern CSS techniques.

So, if you don't know what a DOCTYPE is or you're still using tables for layout, or you're just having trouble with CSS, it's probably time to get up to date on XHTML and semantic markup. It will decrease the learning curve for using CSS layouts significantly.

Time permitting, I'll expand on some of these specific techniques as they relate to CSS in another article in the near future.

UPDATE: And look - Sitepoint just sent out a newsletter about "sprucing up your HTML" knowledge. Perfect timing.

Discuss this article »

Sitepoint recently offered up their 278 page book, "The Photoshop Anthology: 101 Web Design Tips, Tricks & Techniques," for a limited time free PDF download. I passed on buying this one simply because I don't have a recent version of Photoshop, and unfortunately all the good tutorials and resources are for Adobe Photoshop CS1 (many are CS3 now) and up.

It could be that Sitepoint is planning to update this book to a new edition, as Adobe CS4 is around the corner. Sitepoint previously release a Rails 1.0 book for free download as well, but sent out an email about the Rails 2.0 book and upgrade options. They could be using a similar tactic for this PhotoShop book, but free is still free, so go download it.

Discuss this article »

Since I was also looking for CSS work, among other things, I was called for quite a few interface design and web designer positions. It's been a while since I had been job hunting prior to this, so I hadn't really given much thought as to my position title. Afterall, I don't usually pay attention to my title at the places I work even, as they are often made up by Human Resources or other people who don't know the technology much less have any rhyme or reason to them. So "web developer," "software developer," "software engineer," "programmer," etc., (with an optional designation of 1-4 or 1-5) - it doesn't matter to me as long as I am getting paid according to my experience and doing what I like to do, which basically comes down to utilizing my array of skills and having some input into the decision making process on the project.

Back to the topic at hand though. I usually just refer to myself as a "web/application developer." Six years ago I would never have considered myself a "web designer" or a designer at all. Sure, I've been using CSS since the early days (Netscape 4) and Photoshop since version 3, when it came on floppy disks, and have an art background, but I do not have the raw artistic talent and I am generally just not creative on demand (in the artistic sense).

Yet, after hearing all of the types of jobs I was being contacted about, and was actually qualified for, I began to accept the title of web designer for two reasons. First, CSS is how you implement design these days, afterall, and I've gotten pretty good with my CSS layout skills and making them extremely modular. Second, a web designer is simply someone who designs sites and who understands (and respects, IMO) the medium. It has always peeved me when "designers" - who, in light of this discussion, I would now call "graphic designers" instead of "web designers" - push the boundaries without considering the web as a medium and the consequences of their actions on that medium or the landscape of users out there.

In broad terms, considering the web as a medium means understanding the basics of usability and accessibility. These areas span designing for different people and different devices (with different resolutions and various levels of support for underlying web technoligies such as HTML, JavaScript, Flash and more). Wow, those are some broad qualifications for a web designer, who several years ago was traditionally focused on making the site look pretty with graphics. But in reality, a web designer needs to be well-rounded and versed in these areas as well as capable of implementing a design in modern standards-based methods. Without those skills, the person is merely a graphic designer, or perhaps less than spectacular web designer.

Sure, a web designer should ideally be an excellent graphic designer as well. I would consider that to be my weakness, but not a major one, as I'm not a bad graphic designer at any rate. Many techniques (and trends), such as the web 2.0 "style," can cover up a weakness in graphic design. On the other hand, a good graphic designer can screw up a site's design from a usability and accessibility standpoint even if they aren't the ones implementing the final design to code, simply because there are more things to take into account than how a site looks. Functionality over aesthetics; I may be biased since I am also a web developer, but that is certainly the proper order for both web sites and applications in my opinion. Anyone who will tell you otherwise has never been concerned with form abandonment rates, response/conversion rates, completion rates, or other performance metrics and will likely tell you user training will fix it!

To beat a dead horse a little further, I came across this article entitled "On Creativity" by Andy Rutledge on A List Apart while mapping out my own article (that you're reading). I thought Andy's angle complimented my thoughts on the matter quite well, and he explicitly goes into the web as a medium as well as the role and perceptions of creativity in design. Here's an excerpt:

The siren song of creativity is likely responsible for more bad design than any other factor. Some might think this overly dramatic, but I believe we should regard creativity as a rather dangerous tool. Like a firearm, it should be treated with caution and respect, and used professionally only by trained individuals.

If you are a designer worth your salt, you know that no design project begins with creativity. Instead, it begins with client- and/or context-specific discovery, and lots of research to help you understand the fundamental nature of the challenges at hand. All designers must guard against the urge to invest in specific creative ideas before becoming intimately familiar with the contextual landscape of a design project.

Sadly, creativity is often used as a crutch, or as a surrogate for design competence. Some individuals reveal themselves as clinging to this practice when they complain that some client work prevents them from ?being creative.? What they mean here is that they dislike not being allowed to express themselves. But design competence has little to do with self-expression, and creativity is no substitute for knowledge or comprehensive understanding. Instead, design is most significantly founded on the comprehensive understanding and greatly developed empathetic/sympathetic sense that highly skilled and disciplined individuals bring to bear.

The article goes on to make a number of additional valid and valuable points, but it is quite lengthy as well, much like my own article has become.

Reading those points validated my self-worth as a web designer just a little more, knowing that my primary weakness of creativity on demand is not the Achilles' heel that I sometimes feel it is. In fact, on more than one occasion, I've begun coding the actual application only to "skin" it later with CSS and graphics, usually progressively as I am developing and as I see a need and get inspired. This is often very easy to do using a combination of modular CSS and server-side templates. That's progressive enhancement - a term usually reserved for development - in its truest form. Of course, it also doesn't go over with clients very well, as they often can't get past the visual aspects of a site in the first place.

To wrap things up, I think the distinction between graphic designer and web designer fits quite nicely. If you look at the other terms such as interface designer, interaction designer and user experience designer (or architect), they focus on one aspect of the site or experience. A graphic designer does just that - focuses on graphics - where a web designer focuses on the web as a medium and understands design within those boundaries, for lack of a better word.

So where does that leave me and my title? I don't really care, but I will still call myself a "web/application developer" because that's primarily what I'm getting paid to do, and "web developer" can still encompass the CSS aspects as far as I'm concerned. Plus, "web/application designer/developer" just looks too wishy-washy. In that case I'd have to go with "Coldfusion/SQL/XHTML/CSS web/application designer/developer." :-)

On a side note, some companies and recruiters also differentiated "Web developer" from "software developer," where a web developer is considered and HTML/front-end person, which is my reasoning behind using "web/application developer."

Discuss this article »

You can check out the stories we ran today as well as in previous years with the links below:

• April Fool's Day, 2008
• April Fool's Day, 2007
• April Fool's Day, 2006
• April Fool's Day, 2005
• April Fool's Day, 2004
• April Fool's Day, 2003

Some of the better April Fools I've seen done today are as follows:

• World of Warcraft Announces the Bard Hero Class (I don't even play, but this is really well done)
• World Of Warcraft: The Molten Core (not so funny, but you have to watch the video on that page - it's classic!)
• New Xbox 360 Spring Line

I'll update as I find some more really good ones. I wasn't really impressed with Google's attempt this year, but they've had some great ones in the past.

Discuss this article »

The flexibility of tagging is a strong point and the primary reason that tagging caught on several years ago. The many-to-many relationship of tags to the items being tagged make tagging work where hierarchical categories simply do not.

It's great for the general user to label things however they want without restriction. But as any seasoned user of del.icio.us (I have nearly 2500 bookmarks at the time of writing this article) knows, this flexibility eventually turns into chaos. Inconsistencies become apparent as you find that some of your items were tagged singularly and some plurally. People make their own compound tags differently, using dashes, underscores, or dot notation - and some people are inconsistent in that as well. If you start out simple, you may find the need to add more tags later on for greater descriptiveness.

I'm not necessarily seeking a system that will address all of the above issues. Rather, I am looking for a way to create some more order within a flexible tagging system. I could come up with some simple solutions like adding a parent key to each tag's database entry, which would allow for some hierarchy (however messy it would be to take advantage of on SQL 2000 right now). Thinking of some other projects I'd like to use this codebase for, I would also like to be able to have groups of tags that are not in a hierarchy. I.e., the tag group is not selectable as a tag. For example, perhaps I am writing tutorials and want to tag them by technologies used as well as difficulty level (beginner, intermediate, advanced). I could use a flexible tagging system for this, but interface-wise it makes sense to have these tags grouped rather than be free-form entry tags.

While I could certainly construct my own ad-hoc system, I'm wondering if anyone has any experience or has read about more robust taxonomies that may address my needs and could point me to some articles or examples.

Discuss this article »

Seach Engine Safe URLs, Friendly URLs, Pretty URLs, and Meaningful URLs?

What I would call a friendly URL or pretty URL is one that is coded to be the shortest possible. So the following URL:

http://dgibson.net/blog/categoryid=1

might be represented by a short, memorable and typable URL such as:

http://dgibson.net/blog/coldfusion

These types of URLs require a lot of assumptions in your specific application. If you know them upfront, you could implement this in CF or Apache just the same. But then you need to have a different rule for actual articles (as opposed to the category page).

What's The Goal?

First and foremost to avoid the use of a standard query string, which can hinder low-ranking or new web sites from being fully indexed. Surely Google, et al can index dynamic content by now, but they tend to not index dynamic content on newer sites as aggressively. By not using the query string, all of your pages appear static to the search engines, and therefore get index more thoroughly.

Second, by including a URL stub (a human-friendly, keyword-rich URL version of the headline), you are both making the topic of the article known from looking at the URL and stuffing it with some keywords taken from your headline, which should help your search engine ranking.

Like I said, I initially planned to use Apache's mod_rewrite facilities. I've used them before, but when doing so, the URL is always updated in the browser's address as well, which is not what I wanted. Perhaps there's a way around this, but I wasn't feeling like exploring that method because it has a drawback in flexibility compared to the ColdFusion method I ended up going with.

So I implemented SES URLs through ColdFusion. I decided that I might as well let CF do the heavy lifting since I will be dynamically writing out the href URLs in ColdFusion anyway.

The Deciding Factor

Implementation

1. <!--- PARSE OUT URL VARIABLES FROM SES URLS --->
2. <CFSET urlVars=ReReplaceNoCase(Trim(CGI.PATH_INFO),'.+\.cfm/? *','')>
3. <CFLOOP INDEX="qsnvp" LIST="#urlVars#" DELIMITERS="/">
4. <CFIF Find("=",qsnvp) GT 0>
5. <CFSET URL['#ListGetAt(qsnvp,1,"=")#']=ListGetAt(qsnvp,2,"=")>
6. <CFELSEIF urlVars IS "/"&qsnvp>
7. <CFSET URL.category=qsnvp>
8. <CFELSE>
9. <CFSET URL.urlstub=qsnvp>
10. </CFIF>
11. </CFLOOP>

This loops over the Query String looking for name value paris (hence "qsnvp"), and parsing them. If there is only one extra piece of info after the actual CF Script being run, then I assume it's a category. If there is one name-value pair and then a trailing non-pair string, I treat that string as the URL stub.

Here's what a live URL looks like, containing a name-value pair (articleid) and a URL stub: http://dgibson.net/blog/article.cfm/articleid=8/Implementing-Search-Engine-Safe-SES-URLs

So to avoid duplicate content issues, what I've done on my article.cfm page (and upcoming topic pages) is compare the URL stub to the one generated from the database query. If they are different, then I do a 301 redirect to the "correct" version, which should pass all referential value of the first article to the second and prevent the first from being indexed any more.

1. <!--- IF THE URLSTUB DOES NOT MATCH UP, DO A PERMANENT REDIRECT TO THE PROPER ONE --->
2. <CFIF NOT StructKeyExists(URL,"urlstub") OR URL.urlstub IS NOT CreateURLstub(qArticleDetails.headline)>
3. <CFHEADER STATUSCODE="301" STATUSTEXT="Moved Permanently">
4. <CFLOCATION URL="#CGI.SCRIPT_NAME#/articleid=#articleid#/#CreateURLstub(qArticleDetails.headline)#" ADDTOKEN="No">
5. </CFIF>

This bit of code is run after the query on the article.cfm page, which gives me the chance to validate the URL stub and enforce proper linking - or at least page rank transfer via 301 redirect - to the one "official version" of each of my blog articles.

In Conclusion...

I don't necessarily find my SES URL solution ideal by many standards, but I found it simple enough to implement and I'm happy with the real-world flexibility of it. The trade-offs of speed to implement, flexibility and power are always tough calls to make. But I'm always open to suggestions for improvement too.

Discuss this article »

Because I tweaked the headline, the actual link to the article has changed as well, and therefore the GUID in my RSS feed is changed, making it look like a new, unique article. Some systems generate a unique GUID based on a hash of the content, so any change would trigger duplicates.

I just thought I'd mention that as a caveat. I'll definitely have to consider my headlines more carefully before publishing an article in the future. Sorry 'bout that.

Discuss this article »

To backtrack a bit, reset.css is a special CSS file created solely for the purpose of eliminating browser default issues and cross-browser compatibility problems by explicitly setting the styles of elements to be the same in all browsers.

When applying the latest version of Eric Meyer's reset.css, all of my table row striping disappeared due to the introduction of background:transparent; into the main declaration.

Thanks to Eric's explanation, I now understand the issue to be a bug in Internet Explorer, affecting even version 7. He commented on the previous post:

What's happening is that in order to make it look like the 'tr' has a background, IE copies that value to the 'td' elements in the row. It's a visual sleight-of-hand to cover the fact that IE can't actually style 'tr' background. The reset changes the 'td's back to transparent.

The simple solution is to remove the offending background:transparent; from the main reset declaration.

But there is a simple enough CSS solution as well, requiring just a few more declarations or more selectors to the existing declarations. Using the descendant selector, I can keep the reset.css as-is and keep the exact same classes on my 'tr's in tact and make the CSS work even in Internet Explorer with some additional rules.

Here's a sample of my old CSS that was affected:

1. tr.inactiverecord{background-color:#FF0}
2. .greybar,.graybar{background-color:#DDD}
3. thead+tbody tr:hover{background-color:#CCD}

To make this work in Internet Explorer, the following additional declarations would have to be added:

1. tr.inactiverecord td{background-color:#FF0}
2. .greybar td,.graybar td{background-color:#DDD}
3. thead+tbody tr:hover td{background-color:#CCD}

Of course these declarations could be merged with the previous ones since the styling is the same for all of them. However, I listed them separately for clarity.

I also tried to put these new declarations in my iehacks.css, but apparently I was under the assumption that only IE 6 and older needed hacks, because that's what I've filtered for in my conditional comments, meaning thes styles would not be applied to IE7, which remains broken.

1. <!--[if lt IE 7]>
2. <link rel="Stylesheet" type="text/css" href="/styles/default/iehacks.css?v=2.0.4" media="screen,projection" />
3. <![endif]-->

So I'm left pondering the same thing Eric stated in his previous comment:

So now I have to decide: take it out or leave it in? If I leave it in, do I document that quirk in a comment or not?

I understand the intention of the reset.css, and partially agree with leaving it "pure" - i.e. not changing it for the sake of accommodating Internet Explorer's flakiness (I would still document it though). On the other hand, I still don't know of any practical bugs with other browsers and background inheritance that would necessitate such a declaration.

For now, I've decided to keep the declaration since the workaround is fairly simple and the IE bug is limited to table rows.

Discuss this article »

When I saw that CSS-god Eric Meyer had updated his CSS Reset file to version 1.0 and given it a permanent home, I immediately checked it out and integrated the changes into my reset.css file. Granted, it's still mostly Meyer's file, but with some small tweaks.

By way of some background - a reset.css is a special CSS file created solely for the purpose of eliminating browser default issues and cross-browser compatibility problems by explicitly setting the styles of elements to be the same in all browsers.

It wasn't until I had posted the changes live - yes I did test locally first - that I noticed something was amiss with the CSS in Internet Explorer. Upon further testing, both IE 6 and 7 were affected. The main area that seems to be affected are my tables in the admin area, which no one can see of course. In particular the table row striping and highlighting of inactive/draft records was gone. Yet everything looked just fine in Firefox.

The way I stripe my table rows is fairly common inline ColdFusion inside of a query loop - not ideal in some ways, but effective.

<tr <CFIF currentrow MOD 2>class="greybar"</CFIF>>

I changed all sorts of stuff in my main CSS, added greater specificity to the rule in question, added !important, all to no avail. I gutted my table of recently added col and colgroup tags. Nothing.

I removed the reset.css from the header and *poof* it worked again. Finally I noticed a new line of code in the global reset:


html, body, div, span, applet, object, iframe,
h1, h2, h3, h4, h5, h6, p, blockquote, pre,
a, abbr, acronym, address, big, cite, code,
del, dfn, em, font, img, ins, kbd, q, s, samp,
small, strike, strong, sub, sup, tt, var,
b, u, i, center,
dl, dt, dd, ol, ul, li,
fieldset, form, label, legend,
table, caption, tbody, tfoot, thead, tr, th, td {
margin:0;
padding:0;
border:0;
outline:0;
font-size:100%;
vertical-align:baseline;
background:transparent;
}


The last line with the shorthand background attribute is new from his previous version. I took it out and everything worked again.

But why stop there? I'd been having trouble with the background shorthand property in other places, so decided to change it to background-color:transparent. Broken in IE again. I changed it to a solid color to see if the transparent value was the problem (I know it was a problem waaaay back a long time ago, but I don't even remember which browser any more - NS4 maybe?). The entire table turned red, as expected.

Finally, I changed the background back to transparent and immediately after that rule inserted this one:

tr{background:#F00}

Still no effect in IE. So to the best of my estimation, IE either has problems with applying background colors to TRs, which seem unlikely because they've always worked otherwise, or with applying transparency to TDs, or perhaps just showing TRs through TDs. In any case, I cannot leave the background property in that style declaration, so it's gone, and I would recommend you do the same unless there's a REALLY good reason it's in there.

Of course, I'm not ruling out that I could have screwed something up myself, but it seems to be a browser bug with IE if !important and specificity had no effect at all.

Update: For further discussion and potential solutions to this issue, see my follow-up blog, Overcoming "background: transparent" In Internet Explorer.

Discuss this article »

For the record I don't watch those reality shows - my wife does. I was just there for the ice cream!

Discuss this article »

What is happening is that I am seeing a number of requests error out because someone is inserting URLs (all foreign, e.g, .it, .ch, .ru, and a couple .com's so far) in place of my articleid query string parameter.

http://dgibson.net/blog/article.cfm?articleid=http://www.somespammyurl.ru/blah/

If it only happened once, I wouldn't be suspicious, but I have gotten nearly over a dozen of these - all pointing to different sites - in the past 24 48 hours coming from at least three different IP addresses.

This seems like a really ineffective form of referrer spam to me. If I did not have an error handling system set up like I do, I would NEVER see these URLs. Since the "attacker" varies the URL in each request, they would not even show up in my stats sorted by most requested pages. The only way I would ever see it is if I viewed my raw logs. And since the URL is added on to a URL as a query string, any auto-linking would link the entire URL, not sending any more traffic to the spamming site anyway. I just don't get it.

Has anyone else experienced this? What is the point of this spam? It doesn't appear that the attacker is trying to inject anything more than a site URL. It could have been happening to my other sites for years and I'd never even know it.

It looks like my next step is to catch invalid articleids and treat them as a 404 error, as that's what they are essentially. Or rather than pollute my logs with that, just redirect them to the blog index. How would you handle it?

Discuss this article »

You can read my supporting evidence and commentary in full, here on Metal Underground.com.

This is not really the kind of publicity I want for the site or for heavy metal. But the incident has sparked a good deal of support for the job done in moderating the site, from comments to emails. Being a heavy metal site, I try very hard not to be a heavy-handed moderator and I let a LOT of stuff slide (except for personal attacks). After all, metalheads are often rebellious and don't want to be censored. I have a bad language filter on the comments just to keep the language from getting out of hand (and getting the site banned from every search engine and parental watch software under the sun), and new readers often complain about that when they first encounter it!

I just thought I'd share that to say "hey look at me, my site's on the news" as well as point out some stuff that people might not think of when talking about online communities and moderation, etc. - the rules are not the same for all types of communities by far. This isn't something you'll always think about when reading blogs on site building and blogging unless you are one of the exceptions.

Discuss this article »

After having about half a dozen things fall through at once in the week my severance ended, I decided it was time to give up the pursuit of freelance/contract work (as a means to make a living) and get a real/full time job once again. Despite the freelance thing not working out, it was an eye-opening learning experience and I now have a much better idea of what that entails should I go that route in the future. Had I known it would not work out, however, I would have definitely spent a bit more time on my other web site ideas and redesigns.

I'm happy to be back at my former job - the one before the recent one who laid me off - now as a full-time telecommuter. With all of the familiar faces there, I feel like I've been gone 6 months instead of 2 years! I won't mention my employer by name, because I have no intention of blogging about my job and do not want my thoughts expressed here associated with them in any way.

Discuss this article »

In another instance, I was interviewing for a position and I inquired as to why the job posting did not mention ColdFusion specifically, yet the company's flagship application was built on ColdFusion. The interviewer proceeded to tell me that in the past if they include ColdFusion in the requirements, they get inundated with poor quality resumes and developers. So the company had included a number of requirements in the job posting, but omitted ColdFusion. The interviewer also commented that they don't necessarily need a CF developer, as they would consider hiring someone with other server-side programming experience since ColdFusion is easy to learn.

Poor quality of resumes/developers is nothing new. I assumed it is par for the course in hiring, but I have heard similar statements from past employers as well as companies that friends work at regarding ColdFusion positions. I've just never heard of outright not listing ColdFusion as a requirement in the job posting as an alternative or remedy to the situation.

Now I've banked my future on ColdFusion. There are too many other technologies and facets of web development to learn and I'd rather focus on learning those than learning a new back-end language and the ins and outs enough to become truly proficient. Plus I believe in the direction ColdFusion has been headed, even if I don't totally buy into the Flash and Flex stuff. But hearing these statements from people in hiring positions does raise some concerns for me over the future of CF. Certainly there are a lot of talented CF developers out there, but it sounds as if the talent pool is not large enough to support the infrastructure of clients who use ColdFusion. Or perhaps it's simply "watered down" substantially with inexperienced developers. It's definitely food for thought.

Discuss this article »

The seasonal aspect of online advertising is something I've always kept in the back of my mind with respect to when I could potentially attempt to do blogging full time. For anyone out there with similar thoughts, I don't recommend quitting your job in January to become a pro blogger!

In general, advertising revenues are a bit low at the start of each quarter and require some ramp-up time. However, at the start of the new year, which is also after the advertisers' big holiday spend, online advertising is horrific. Ad networks' fill rates are low and CPMs are roughly cut in half or worse. It is normal for things to not start ramping up until mid-February, and even then the CPMs and fill rate - and therefore overall earnings - may be a bit "off" until well into Q2.

So when is the best time to turn pro blogger? It really depends on the type of site(s) you run. Like advertising, many niches have seasonal trends as well. Looking at the advertising trends alone, and assuming you have an existing blog or three, I would advocate watching your earnings trends through April and May and if all looks well, consider making the jump in June. The more preparation and traffic building you can do leading up to that point, the better. I would not make the jump any later than October, however, because then your window for building traffic before the holiday season is over is very small and you'll be facing the the first quarter draught of the next year very soon afterwards.

What the earnings threshold is for an individual to feel comfortable leaving his or her day job to go pro blogger is another question entirely.

Discuss this article »

But back to the actual topic I was meaning to discuss. Looking for work is hard work. I've been busier than ever the past few weeks and not even working (much). One of the most time consuming parts of starting a job search is posting your resume on various job sites and recruiter/staffing firms' sites. I've been talking to a lot of staffing firms (Aquent, Robert Half, TEKSystems, KForce, etc.) and most of them have their own proprietary site that you need an account on to be considered for their positions, even though I see most of their positions from job aggregator Indeed.com.

The time consuming part is that it's not just enough to upload your resume. Most of these sites then try to parse the information out into data fields, and you need to go through each of your job entries and clean this data up. I've been in the computer industry for almost 14 years now, so their are a fair number of entries there. I probably spent the better part of two or three days just getting my information in to these various online systems. Then, of course, you talk to the recruiters, and many require an interview with them before they will really consider you. This is all expected, but I was just shocked at how tedious the online process has become.

The other aspect of looking for freelance work is researching and discovering the best venues (sites) to find freelance work on in the first place.

Luckily most sites have RSS feeds now and many, such as Indeed.com, have RSS feeds for specific search results. RSS has been the real life saver once I got everything going in my job hunt. I don't know when I would find the time to visit all of the individual job boards I've responded to jobs on if I wasn't finding those postings via RSS.

Discuss this article »

I already had plans to relaunch dgibson.net as a blog, but now I've pushed that effort ahead so that I can begin blogging and use this site to leverage my chances of landing some freelance work. Dgibson.net had not been updated for close to 7 years, sometime after I got married, so the redevelopment is much overdue anyway.

In the meantime, I'll be doing some house-cleaning and rounding out the template design and populating it with information, and likely blogging about my job hunt and other web development topics as well.

Discuss this article »