Aki Björklund

Position on an Axis: my new blog

2009-11-17T12:50:50-08:00

This blog is not dead, yet. I am trying to agree with myself on a schedule that I can realistically follow. I will write some posts in the buffer before I can begin with that.

While I do that however, you might also like my new sideblog titled Position on an Axis (feed) at an address that my longest-time readers probably remember. That blog is about a lot of things among the familiar web development related ones, but with a more personal touch. One might say it has a lot lower threshold for publish. I hope that makes it more interesting and entertaining.

Best books on web development?

2009-10-18T12:15:30-07:00

I’m thinking of building a definitive list of books on web development. Software development in general should not be forgotten, but the focus of the list would be in great web software development.

Only the best books would be listed so that the list could serve as an educational tool. This is why I am asking your help.

What are your favorites? Let me know in the comments! Books on specific server-side technologies are fine too, the list will be categorized.

Without too much thought, here is a short list of 20 books to get you started:

The last 10 books suggested by Sami Poimala, thanks! (I now have to actually read all those.)

A website is never done

2009-09-02T04:35:08-07:00

On a recent post in that I warned against multi-vendor web projects. I ended with a claim:

A website is never done. It should be constantly analyzed and developed further. Perfection is a forever moving target. Don’t try to nail everything at once.

This is a serious issue. Even more serious is that it is generally very hard to find a vendor that can actually deliver something like that.

Why?

Consultancies are organized around delivering projects. They have little or no organization to actually continuously develop websites with high quality. Sure, there is maintenance people, but that is often an afterthought and only activated if the client is asking for changes. When selling more to an existing client, sales people unsurprisingly put their effort into selling big projects, not small incremental upgrades.

Web development must not be done in two to four year cycles when everything gets ripped down periodically. That is just insane use of money and in most cases PageRank.

There should be a symbiosis where technical people feed the client with new ideas concerning content (organization of, new types of, better cross-linking etc.) and techies get challenged daily by the continuously changing environment.

One reason for this kind of behavior is that good developers demand to build cool new things and that is what the company then sells.

Even more alarming is that continuous development is generally considered being something lowly. Sure, many of the tasks are not that challenging or sexy.

But.

I spent years on my previous job practically developing a single site. Not once I felt it was something unworthy of me. Not once I felt bored.

It taught me unbelievable amount things that now make me respected at my current job. Why? I had to solve real-life problems, not just problems that aroused during the requirements or the design phase. To solve those kind of problems cleanly, I really had to know the domain.

Developers should sell small improvements directly

Keeping it small requires that no sales people and preferably no project managers are involved.

Developer makes a well argued proposal with an estimated amount of hours of work and the client accepts or abandons it. Client gets billed on actual hours worked, not by the estimation.

This of course requires a contract of some kind. But after that is done, selling costs are rapidly approaching zero.

This kind of arrangement must be based on a mutual trust or otherwise it will not work. I believe this could work with all but the smallest sites and clients, not just with the biggest.

Clients should reserve a budget beforehand for these kind of small incremental improvements. Maybe build a little less features in the initial phase and add more as there is real-life understanding of how the site is actually used?

Developers will be happier when they have their own child to look after and more influence over their work.

This results into better websites for sure. Maybe it costs a little more, but the site should bring in more money too. If not, you are probably not basing your decision making on measurable metrics.

Web developers’ areas of expertise

2009-08-08T12:30:37-07:00

What should a web developer know? More about web or plain programming? I believe it is often far more valuable to know the domain really, really well than it is to be highly skilled in programming.

Web developer’s development skills can be divided into three categories:

Open web technologies and practices
Server side web technologies
Generic technologies and development techniques

This is my incomplete list of things that every web developer should know about the web:

HTML: What is the purpose of HTML; What is semantic HTML; All the common elements and their attributes; What is the Doctype and what does it do; HTML vs. XHTML, what are the practical differences; HTML5 philosophy and major new additions
CSS: Selectors and their browser implementation statuses; Basics: margin, padding, border: the box model; Positioning with float, position; Some experience in building a simple layout in pure CSS; The difference between quirksmode and the standards mode; General understanding of CSS levels 1–3 and their implementation status in browsers
JavaScript: Deep understanding of the language; Progressive enhancement; jQuery experience; Ajax and JSON basics; Browser manipulation: URL, cookies, etc.
HTTP: What does a HTTP request consists of; Common response codes and their proper use; How cookies work, what are their limitations?; How to read and debug HTTP traffic; Cache control; Statelessness and how to fake it (and why not to fake it)
URI: What is the difference between URL, URI, and IRI; How is URI structured; How and when to use the query string; How does the hash (fragment) work; Cool URIs don’t change
Browsers: Browsers current market share; Browser differences; Browser quirks (IE); Browsers current and future standards’ implementations and other features
DOM: What is DOM and why does it exits; How to view DOM; Standard API to modify with JavaScript
DNS: How does it work and how browsers use it; How to use the hosts file
Usability: Focus on simplicity; Usable forms; Writing for the web
Accessibility: What is it and why is it important?; Accessible forms; Accessible navigation; WCAG
SEO: Why title is an important element; Link economy; Canonical URLs; Every page is linked to with normal links
Security: XSS; CSRF
Miscellaneous: Web feeds (RSS and Atom); RESTful web development; XML; XSL, XPath; Overview of W3C standards and other web standards

I probably did not think of everything, so feel free to add your suggestions in the comments.

In addition to that list, you should of course know enough about the server side technologies too. Know thoroughly at least the programming language, web framework, your database of choice, SQL as a language, something about scalability and performance, security basics and so on. Learning will not end on this side either.

Useful generic technologies and development techniques include writing readable code, designing highly reusable object-oriented software, agile methodologies… I won’t try to make a comprehensive list here.

Where to focus?

More often than not a programmer focuses on programming only. That often results into unusable or otherwise bad websites. Web is a domain like no other. Of course, developing in any other platform will be much more effective if you know the domain.

Focusing your learning efforts on open web technologies gives you several benefits:

The first benefit of focusing on the open web technologies is your agility to switch platforms. The more you know about the web, the easier and faster it is to start developing in a new web development platform, from switching CMS’s to a massive leap of one technology stack to another. There is also less of a vendor lock-in, which gives more options for your career.

Second, your ability to work efficiently with web designers grows. You are able to deliver solutions that make their work easier.

Third, the complete solution is likely to be much more web oriented and thus a better one.

Fourth, you learn something that tends to be more long-lived knowledge than typical vendor-specific technologies.

It never ends

No wonder most of us feel sometimes a bit anxious about all the things we have to learn. And when we do learn, it is mostly rendered useless after a couple of years.

A developer is never out of school.

The trap of multiple vendors in website design and development

2009-07-23T07:51:11-07:00

Summary: If you have a big or important website to build, do not – under any circumstances – built it using multiple vendors.

Problem: Your company needs a website of some kind and you have not enough resources or expertise to build it yourself.

So you want to hire a company that does that sort of things. What general options are there and what are their strengths and weaknesses?

The three general types of companies that could help are:

Advertising agency
Web consulting company
General technology consulting company

Here is a little table that tries to capture their pros and cons:

Competence	Advertising agency	Web consultant	Technology consultant
General technology	Low	Medium	High
Web technology	Medium/low	High	Medium/low
Web domain	Medium/low	High	Low
Web strategy	Medium	High	Low
General marketing	High	Medium	Low
Visual design	High	Medium/high	Low

This is of course a very simplistic and subjective table. There are always exceptions and individual differences. Many companies cannot be put into these categories.

The choice is pretty easy if you need a simple website and can make compromises.

It gets harder if you need, say, a visually stunning website with a scalable back-end.

What do companies usually do in these situations (and sadly, often when they do not actually need to)? They buy the specification work from one company, visual design from another, and the actual implementation from a third company. In the specification or the visual design phase there usually is not yet an understanding what the technology platform will be.

This leads to multiple problems:

Communicating design decisions becomes extremely time-consuming and error-prone.
The implementation will cost a lot because the limits of the platform cannot be taken into consideration beforehand.
Developers and designers get unhappy because their chances of making a difference is lower.
The probability of success is lower – the forced waterfall model does not easily allow correction of mistakes made in the beginning of the project.

So basically: you will have a website that has some weaknesses (from a single vendor) – or you will own a generally bad website that cannot be fixed easily (from multiple vendors).

So what do I suggest?

You find a single company that has the best record of delivering great websites in all areas that matter to you. Usually that is a company, that specializes to web development and design. Remember that a lot can be fixed afterward, but it is harder, if the basic design decisions were wrong. Money should be reserved for that too. The more players there were in the development for the website, the more the corrective measures will probably cost.

A website is never done. It should be constantly analyzed and developed further. Perfection is a forever moving target. Don’t try to nail everything at once.

From this post on: only in English

2009-07-17T00:49:04-07:00

I have been blogging for about 6 years now. In that time, I have only blogged in English a couple of times.

It is time for that to change.

I have no other motivation behind the change than to practice my written English. I certainly don’t hope to get a much wider audience. Even thou I would have no objections, should that ever happen.

I would also ask you to comment in English from now on. I know, that will at first seem like a bit stupid, mostly Finns discussing in English. But, after a short period, that feeling went away in Twitter too.

I obviously will not be translating the older posts, but the tags I will (again). The UI is mostly translated into English by now. Anything else I should be considering?

SuperGenPass is not that secure

2009-07-16T12:38:55-07:00

Update: SuperGenPass vulnerability demo for people that don’t believe me.

I know, I have recommended that you use SuperGenPass for several times. It took a long time, but I finally realized there is a serious security flaw in the root of the implementation.

The SuperGenPass UI is rendered within the DOM of the current page when you click the bookmarklet. The UI is where you enter your master password. And because the UI is part of the current page, any script running in the page can read your master password. Remember that script can be external too, as in advertisements or widgets of some kind.

It if safe to say that using SuperGenPass is not that different from using the same password for every site. It just has a little bit different issues.

If you use the same password everywhere: When a site gets compromised in a way that the attacker can read the user account information, your account in every site can be compromised – depending on how the site stores their passwords.

If you use SuperGenPass on a site that is compromised: Your master password can get stolen and thus, your account in every site is compromised.

The difference is in the way site gets compromised. Something as common as a cross-site scripting attack will get your master password in jeopardy.

Fortunately, there is a safe way to use SuperGenPass. Just visit a page you absolutely trust not to have any unauthorized script running. Generate your password within that page by manually entering the domain name that you are trying to log in to. Then copy & paste it into the login form. Cumbersome, but it works.

At this point, I would not recommend SGP to anyone but security experts.

“Free” as in “free beer,” not as in “free speech”

2009-07-16T10:29:34-07:00

Chris Anderson’s latest book, “Free” is free on Amazon to download for the Kindle or the Kindle app on the iPhone or iPod touch.

Or is it? No, sorry, to access it you need the Kindle (not available outside United States) or the Kindle app. If you try to download the app from the iTunes Store without an appropriate account, it says:

But I am not purchasing anything! I am simply trying to download a free piece of software! To access a free piece of content. And I am not allowed to do that in a disrespectful way.

Way to go, Amazon, Apple and Chris Anderson!

Free is also an ideology. Don’t forget that.

Mitä Digg aikoo ja ei aio tehdä IE6-käyttäjille

2009-07-13T06:44:20-07:00

Diggin blogi toteaa tutkimuksensa perusteella, ettei kaksi kolmesta IE6-käyttäjistä yksinkertaisesti voi päivittää.

Giving them a message saying, “Hey! Upgrade!” in this case is not only pointless; it’s sadistic.