The blog that I had there was the same as this one which I now host myself using WordPress so, many months ago, I deleted it. I suspect I was probably in a web presence consolidation mood at the time. Today when I tried to recreate that blog at the same location, ahewgill.blogspot.com, I found out it was already taken. No biggie, I’ve experienced issues with persistent data in web services before, so I pointed my browser to the site and was totally surprised by the result. Why is my site all in Japanese? Where did all my posts go? Wait … something seems fishy here.

It seems that a Japanese blogger took over my old URL for what I can only assume is Search Engine Optimization (SEO) reasons. I suspect that they wanted the benefit of the PageRank of the URL and all the links from random search engines around the world. I can’t confirm this of course because there are no markers that would suggest it was true. There is only one external link that goes to another dead blog with no links which wouldn’t help anybody, its all very curious. It just goes to show you that cleaning up your web presence might not always be the best idea. Now I am just biding my time until he deleted his blog to take it back :o).

Note: I didn’t actually link to the URL of my old blog since it would cause a chain reaction of linking in the Blog-o-sphere via the ping-o-matic system that would suggest I promote that persons site, you know … FYI or whatever.

My web programming/design skills have greatly improved over the last year (mostly the former) and I am somewhat proud of the look and feel of dev|sushi, however it has a long way to go to get to what I am envisioning for it.

In the last month I have been extremely busy both at work and at home. I have taken on several web projects and am fighting my way through them. The thing about being busy is that it doesn’t leave much time to do fun and interesting things. I haven’t been out to train for Parkour in around a month and the only exercise I have been getting is an occasional swim in the local pool. Unfortunately that has come to an end too! The university pool is under construction and is closed but during the spring term but we have been able to use our Watcards to get into the Waterloo Swimplex which has been great. Earlier this week Sara and I went to go but were turned away. I was like WTF! (pardon my msn slang) Apparently since the spring term ended on August 11th anybody kicking around campus is out of luck until the students return in September. le sigh.

Before this week I hadn’t played a computer video game for around a year. I was too busy to even think about installing anything but I finally broke down and installed Grand Theft Auto: San Andreas (GTA:SA). OMG! I love it already. I’m getting soooo good at cycling its crazy. :o)

Currently this site has a few experimental features strewn about haphazardly. The green gradient behind this text and the green highlight behind the links to the right are both background images which are very widely used on the web currently. However these are thrown together quickly and don’t look very good. The stark edges of the gradient are really harsh next to the next and the button border is not even as its wider in the corners. In addition the text of the right links looks very bad in both highlighted and normal state.

The revamp and the new site will both use wordpress and hopefully will include a much less default wordpress look. I’ve been greatly inspired by the creativeness of Bryan Veloso over at Avalonstar and many other bloggers of the 9 Rules network. However, be warned I am no designer so don’t expect too much from the non-technical side of the projects.

In the weeks before Fall 2003 when the students arrived the W32.Blaster virus was bring down networks all over the world. Our university instituted a policy to have all internet services disabled and only enable them one by one after the students machine was certified clean and was patched to protect against it. Our network stayed up. We started to notice very strange things happening with students’ computers that turned out to be SpyWare/MalWare infections.

Over the summer prior to Fall 2004 I developed a CD which walked the student through the long and arduous task of preparing Windows to run safely on our network. It downloaded windows patches, Symantec Anti-Virus, Anti-Spyware and directed them to turn on a firewall. Some flaws quickly bubbled to the surface. For the most part it worked well for everyone however in certain situations the computer became infected in minutes which is far less time than it takes to install Windows patches. We were still very busy but overall it greatly reduced our workload and we considered this a resounding success. I also attended the ResNet conference at Princeton and was blown away by how helpful it was. Every school seemed to be dealing with the same issues as us.

During the next year we learned more and more about SpyWare/MalWare which was becoming the issue with computers. When a particularly damaged computer was discovered I was called in as the last resort to formatting. In most cases I was successful thanks to the now famous netsh int ip reset. During this period my job shifted toward tools and Linux. I wrote Perl scripts and used various tools to help with the administration of the network and the discovery of problem systems. The summer brought yet another ResNet conference which I attended at Georgia Tech and learned quite a bit.

A new technique was implemented for the students moving in during the summer term. We had them enable the Windows XP firewall and install Symantec Anti-Virus after which time we would enable them and they could update windows freely without fear of infection. It was a great success and cut our issues down to a handful. We have since streamlined the technique with even greater success and for the first time had idle staff during the move in period.

My job working with Linux came to a halt since it was evident that we didn’t need to develop any heavy-handed student computer management software. At this point I started to develop websites (yet another shift). The first project was to replace the Off-Campus Housing Listing Service website with a new friendlier interface. I had very little experience with web programming and so created the first website using ASP which was the language in which the old site was written. After it was finished I looked at ASP.Net for the next project and decided to switch for the increased programming library. It is nearly a year later and I have developed many applications and continue to improve our web presence. Currently I am looking into Web 2.0 techniques for use on internal applications. I imagine this is what I will do for the rest of my time here at UW, web applications are the medium of the future.

Quite a few years ago I setup a Yahoo! account using the user ID ‘hitman200ca’ for the express purpose of playing Pool on Yahoo Games with my friends at University. By the way, I love that game despite all its flaws, its really fun. A couple years ago I decided that I needed an online calendar. The Hotmail one included with my 25MB (!!) paid account (boy times have changed) was no good to me. There were (are?) too many bugs including a particular one that didn’t allow the email reminders to be sent for me. I dusted off my Yahoo! account and started using Yahoo! Calendar which incidentally I loved because of its features and it just worked great. Now when it came time to share my calendar for work purposes I was a little embarrassed by the Yahoo! ID I had selected so I created a new account with a more grown up ID. After a short migration period I deleted my old Yahoo! ID and continued on happily.

The first time I realized there was a problem was one day when I noticed that I received two reminders for a birthday and then two more again. I took a look at the emails and noticed that the extras were coming from my old account that I had deleted. Immediately I went to go and delete all reoccurring event in my old calendar but of course since I deleted it Yahoo! would not let me login anymore. I contacted Yahoo! support several times over the next few months trying in vain to get the extra reminders to stop. I received some generic responses that looked as if the support person noticed the word ‘Calendar’ and sent me a form response but no luck.

Yesterday I thought of a new thing to try “Hmm… I wonder what would happen if I signed up for ‘hitman200ca’ again?”. After a couple minutes and an activation email I logged into Yahoo! Calendar and lo and behold my reoccurring reminders were still there. I was so pleased with myself I immediately deleted the events and then deleted the account again.

But wait, what if someone other than me signed up for ‘hitman200ca’? I’ll bet you can guess! I looked through the documentation on the pages when I deleted my account and it certainly said Calendar was among the things deleted. Also it was much longer than 90 days between the time I deleted the old account and the time I noticed the extra reminders (GMail conversation threading, didn’t notice the (2)). I hope my experience was an isolated incident but I doubt it was.

As for me, I am starting to migrate my calendar entries into Google Calendar so I can get away from Yahoo!. Although I’m sure that nobody over there cares much, oh well.

I am working on a personal project called bookkeeper which is a database for the books that I have read and what I thought of them. It started a ways back as an excel spreadsheet then evolved into an access database and then into a web application in php/mysql. My intention is to eventually make it so others can also use bookkeeper, but that isn’t going to be for a while.

Password storage was the first thing to tackle and turned out to be pretty simple. Storing passwords that have passed through the SHA-1 algorithm is the standard practice but has certain security issues. An improvement suggested it to create a unique random string per user to add to the password before hashing it. This reduces the ability to perform dictionary attacks on the hashed passwords. The random unique string is called a salt value and is stored alongside the final hashed password in the database for later comparison, I use an MD5 hash of a number from rand() cut down to twenty characters.

The next issue was session handling and security for the rest of the pages protected by the login page. The standard seems to be to use session_start() which by default generates a cookie containing a session id which you can check at the start of each script page and redirect to the login. So if you are like me you immediately think, ‘what about malicious users?’. Session hijacking is the default scenario seems very easy to me so some precautions are a good idea.

1. Make sure to call session_regenerate_id() after every user login so that the old session id is discarded. This will prevent a user from changing the session id cookie to look at another user’s information after logging in normally.
2. Don’t trust that the session id stored in the cookie is valid. After the user login store the new session id in the database to be checked at the top of every page before the rest of the session information is trusted. This will prevent a user from changing their session id to become another user while logged in.

That is all I have so far. I would really love to hear how others do this stuff and if there are some issues I haven’t mentioned here that are important to remember. Please send in all your paranoid security methods.

As a side note I am very curious about what web platform and server languages Google uses to write all its applications such as search, gmail, google maps, etc. Currently I assume it is CGI with the back end written in with a C like language or something home-brewed.

Here are the finer points:

1. Completely JavaScript/CSS/XHTML built so no server side stuff is required.
2. No tables at all in the calendar control so the design is more flexible and easier to style across different browsers. I used horizontal rollover lists for the day rows instead and they work very well. This means there is no need for extra JavaScript to light up the days on mouse over just use a:hover.
3. Very simple to include in a website. Just need an element with a .value property, a div container and to include the .css and .js files.

Demonstration

Grab the files you need here (right click -> save as…).

1. datepicker.js
2. datepicker.css
3. index.html

I tried to keep everything as simple as possible so you might need to expand it to fit your needs. Please let me know if there are any issues with any browsers you test on.

ASP.Net Calendar Issues:

1. Clicking on the calendar for changing months or selecting days requires a post back and requires extra Page_Load code to pass by any processing code that shouldn’t be run before the form is filled out.
2. Placing an asp:Calendar control in your form puts a table into the page source.
3. The calendar control doesn’t popup by itself. It requires a bit of JavaScript finagling and a surrounding div. Working JavaScript into an ASP.Net application isn’t the easiest thing to do.

There are probably a few more, but I stopped working with the calendar control and started to build my own simple JavaScript/CSS one with much better flexibility.

It is certainly possible to overdo it when using a technology such as this and so I will give, as an example, an application with a good need for it. Generally the new information that you are going to load into the current webpage will be collected from a database. The primary page that the client will load is a simple query with many records but not much detail. The point of this is to reduce the load on the database server and improve the responsiveness of the page. Now the detailed information for each record can be loaded on demand based on the user’s actions, such as clicking a certain record.

You might be thinking: “What is the point of that? Just have the click go to another page with the rest of the information or use a popup.” Both of these options are possible of course and have been used many times successfully in the past. What we want to do is set our site apart from the rest, not blend in. By using XMLHTTPRequest and some simple JavaScript we can generate a new fly-out section accessible via some visual cue beside each record. These fly-outs start empty and are filled by JavaScript when the data is returned. Done correctly the user will never notice that the information is being loaded on the fly and will be impressed by the dynamic nature of your site. The bonus to us is that the amount of bandwidth generated by our web application is reduced.

Google has an amazing suite of very novel applications that use XMLHTTPRequest to make the user experience that much more impressive: Google Suggest, Google Maps and GMail (if you don’t have a GMail account let me know and I can invite you). I am now a firm believer in more functional web applications as I believe that web based (platform independent) applications are a much better idea requiring less work for system administrators.