Gmail insecurity - check your filters - you may have been hacked

David Dairey's .com domain name got stolen by an online criminal, exploiting a gmail security vulnerability (now fixed). The scary thing about this is that the exploit added a filter to gmail, so even after Google fixed the security whole, any malicious inserted filter continues to do its evil actions. Read the entire story and check your filters !

How to put HD video on the web with latest flashplayer

First I want to make it clear that I am all for open web standards and requiring the latest flashplayer for showing some video on your site always degrades the user experience, no matter how much effort you put into avoiding that. So if you wanna depend on latest flashplayer, there must be a strong reason for it. Flashplayer 9.0.125 (released about a week ago) offering high quality codecs (h264/HE-AAC) might be such as strong reason, the audio/video quality is excellent and filesize of the videofiles is relatively small. Here the required steps to produce such a video and how to put it on a webpage without degrading the user experience too much.

Let's assume you already have your original video file in high quality and large file size, either form a HD video camera, a screen recording application or most probably as a result of post processing with a video editing software.

First you must transcode your media to h264 video / HE-AAC audio and put it in a mp4 fileformat. I assume there exists some software from Adobe which does that for you, but I am not familiar with their current commercial offerings. In my case I put together an open source toolchain to perform the transcoding.

Now you have the video as a *.mp4 file. Next you need to prepare your website to embed the video with a flash videoplayer (there are others which work equally well, just the code below probably neds to be slightly modified). The tricky part is that you require the latest flashplayer, so I suggest embedding via Javascript and with SwfObject, that allows to upgrade to the latest flashplayer via Adobe ExpressInstall, if Javascript is enabled. And what if Javascript is not enabled or not available at all ? There is a solution for that: "Extended" markup, which results in either the video or an alternative content (bur no easy upgrade via flashplayer ExpressInstall). Here the embedding steps in detail:

Load swfobject.js (Javascript library):

<script type="text/javascript" src="{{ path }}/swfobject.js"></script>

Register the video (via Javascript):

<script type="text/javascript">
 swfobject.registerObject("{{ video-DOM-ID }}", "9.0.115", "{{ path
}}/expressInstall.swf");
</script>

Extended HTML markup for embedding video:

<object id="{{ video-DOM-ID }}"
classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="800"
height="620">
 <param name="movie" value="{{ path }}/mediaplayer.swf">
 <param name="allowfullscreen" value="true">
 <param name="menu" value="false">
 <param name="flashvars" value="file={{ path_to_video }}&image={{
path_to_preview_image}}">
 <!--[if !IE]>-->
 <object type="application/x-shockwave-flash" data="{{ path
}}/mediaplayer.swf" width="800" height="620">
 <param name="allowfullscreen" value="true">
 <param name="menu" value="false">
 <param name="flashvars" value="file={{ path_to_video }}&image={{
path_to_preview_image}}">
 <!--<![endif]-->
 <h2>To view the video:</h2>
 <p>
   <a href="http://www.adobe.com/go/getflashplayer">
           <img src="http://www.adobe.com/images/shared/download_buttons/get_flash_player.gif"
alt="Get Adobe Flash player">
         </a>
 </p>
 <!--[if !IE]>-->
 </object>
 <!--<![endif]-->
</object>

Remarks:

• all {{ path }} variables need to be replaced with the actual path or URL where you have your static content.
• {{ path_to_video }} : the path or URL of the actual video file
• {{ path_to_preview_image }} : path or URL of a preview image

Example:

• as explained above, and inside this blog (requires editing the blogger template, if you wanna try that out yourself)

ErlyComet article and screencast

Today my article "Getting started with Comet on Erlang" got published at CometDaily, there is also a screencast there (scroll down there, to the ErlyComet section) if you prefer to watch and listen ...

Update: Some users could not load the screencast / did not like to get asked for upgrading the flashplayer. I halfway expected this. It's not that I haven't put in efforts to avoid that kind of bad user experience, but my efforts apparently failed. Let me explain in detail: the video is encoded in h264/HE-AAC and that only works on flashplayer 9.0.125. If the flashplayer is not the very latest one, a dialog should inform the user (and provide direct link) to upgrade the flashplayer, if he wishes to watch the video. Uploading the original QuicktTime screencast to youtube or google video results in bad, mostly unreadable text quality, similar to all those RubyOnRails screencasts which have been originally recorded in QuickTime.
Nevertheless, here is the google video version (bad quality).

The web hosting services of different hosting companies include the most additional features of domain registration free of charge. The web site design of varied websites is developed by the professional web designers who have artistic touch of Excellency. If you want to have direct and fast internet access, you should subscribe reliable broadband service providers. The website development services are offered by the different IT companies to boost up the significance of web site into the main search engine.

Erlang TextMate integration - Documentation lookup

I have made some progress with ErlyMate, my pet project for adding first class Erlang support to TextMate. Based on a new architecture with an Erlang background server (starts and stops together with TextMate, wrote a Cocoa plugin for that) I implemented a very first and highly experimental approach of edoc lookup. More technical details can be found at the googlecode project page.

And here a screencast to show you how it looks and feels like (requires latest flashplayer, and asks you to upgrade to it, if you don't have it, because video is h264/HE-AAC encoded):

Rubinius - the next generation Ruby virtual machine

The guys at Engine Yard, a RubyOnRails application hosting company are serious about solving the Ruby performance issues (Ruby is interpreted) and they are developing a virtual machine. Straight from the Rubinius homepage:

Rubinius draws on the best virtual machine research and technology of the past 30 years and incorporates the newest research in dynamic language implementations. Rubinius implements the core libraries in Ruby, providing a system that is much more accessible, easier to develop and to extend.

And what's in the bag for an Ex-Ruby-developer (Ruby it is a great language, but since I am comfortable with Erlang, I don't have any use for Ruby anymore ...) ? Well, TextMate, my preferred editor has a lot of its functionality implemented as Ruby scripts, and if they run faster with Rubinius, that's fine for me.

Benchmark - ErlyWeb vs. RubyOnRails

Yariv Sadan, the author of ErlyWeb, has benchmarked his Erlang MVC web framework against RubyOnRails 2.0 and according to his results, ErlyWeb is outperforming RubyOnRails by factor 47. [Corrected: it's 6 now, see Update]

If Ruby is on Rails, than ErlyWeb is on rocket engines !

Update: This number is far too good to be true ! In fact, Yariv had Mongrel running in non-production mode, in his corrected version the ErlyWeb outperforming factor went down to 6.

Erlang R12B-0 on Leopard

Yesterday Erlang R12B-0 was released. Compilation on Leopard (with XCode development tools installed) was straight forward, except for one Erlang application: the new profiling tool percept, which got disabled because of missing libgd library at the ./configure step.

So I installed it via macports:

sudo port install gd2

unfortunately ./configure continued to complain. Finally today a solution for how to run ./configure was posted on the Erlang mailing list:

./configure --with-gd=/opt/local

and everything went without further problems ...

There a lots of new features and improvements, and I look forward to explore them one by one in the next weeks and months. Just the troublemaker percept I had to inspect immediately. It seems to be a powerful tool for performance analysis and it ships with a module called edg which wraps libgd and serves for creating 2D vector graphics (to visualize the percept profiling results), similar to my own erlycairo, but it produces*.gif files (erlycairo only outputs *.png files).

Updated ErlyCairo

Did some housekeeping on my growing inventory of Erlang open source projects targeted to web development. I completely rewrote the Erlang part of ErlyCairo, the Erlang bindings for the Cairo 2D graphics library. Previously it had a hard coded node name for the C-node, now it is based on a much more flexible gen-server approach.

Below see how to use this software to create a simple, purple, 100px * 100px PNG image:

start() -> 
 erlycairo:start_link().

%% if you run multiple C-Nodes, to avoid nodename conflicts 
start(CNodeNumber) -> 
  erlycairo:start_link(CNodeNumber).
    
stop() -> 
  erlycairo:stop().        

create_images()->
  rect("rect.png", 100, 100, {1.0, 0.2, 0.7, 1.0}).

rect(File, Width, Height, {Red, Green, Blue, Alpha}) ->
  case erlycairo:new_image_blank(Width, Height) of
      ok ->
          erlycairo:set_source_rgba(Red, Green, Blue, Alpha),
          erlycairo:rectangle(0, 0, Width, Height),
          erlycairo:fill(),
          erlycairo:write_to_png(File),
          erlycairo:close_image(),
          ok;
      {error, Reason} ->
          exit(Reason)
  end.

Amazon EC2 / S3 Network Performance

Thorsten von Eicken (CTO at RightScale) did some bandwidth measurements, here an overview of his analysis:

EC2 <-> EC2 (large instances):

• one connection: totally 75 MB/s
• three connections: totally 96 MB/s

S3 <- EC2 (large instance, HTTPS, download):

• one connection: totally 12.6 MB/s
• eight connections: totally 49.8 MB/s

the results for non-SSL (HTTP) are about the same.

S3 -> EC2 (large instance, HTTPS, upload):

• one connection: totally 6.9 MB/s
• twelve connections: totally 53.8 MB/s

TextMate is the most popular Rails development environment

So I am hopefully on the right track with my attempt to improve Erlang support for TextMate !
Tim Bray asked 1000 Ruby / RubyOnRails about their preferred development environment, below just the most popular ones, for the complete table go to Tim Bray's Ruby survey.

	All	%	Ruby	%	Rails	%
TextMate	478	30.35	216	24.24	262	38.30
Vi family	345	21.90	217	24.35	128	18.71
NetBeans	184	11.68	93	10.44	91	13.30
Eclipse	175	11.11	101	11.34	74	10.82
Emacs family	198	12.57	132	14.81	66	9.65

Disaster recovery nightmare with mozy.com

Shit happens and usually when you don't expect it, in my case I lost some personal data on my mac (iTunes and iPhoto library). I had signed up with Mozy for automatically backing up my data and easily restoring it, so I thought it just needs a few mouse clicks and everything is fine again. Unfortunately that was not the case. The pictures above show how both restore methods they offer (online restore and download-file-and-restore) failed (even after multiple retries).

Mozy support staff seems to responsive and friendly, but that's all. The copy-pasted text below is from an email they sent me 21 hours ago:

I will continue to do more research on this, and tomorrow our mac specialist will be in the building and from there we can work on a more permanent solution.

Lessons learned:

• Don't trust your data to a fast growing startup company. In my case it was Mozy. But I believe this can happen with any other of these over-hyped cheap-service companies.
• Don't test the backup service by just restoring a simple file. Take the time to do a test restore of your real valuable data at its full size.
• Choose at least two totally independent backup solutions.

Faster interaction between Erlang and TextMate

My first attempt of combining TextMate key bindings to Erlang scripts was fully based on escripts. Unfortunatley starting an escript costs some time (because of the startup of an Erlang VM), on my mac it is about 0.15 seconds. Not much, but enough to be perceived as short delay by the user. So I was looking for a faster way of interaction and Erlang core developer Bengt Kleberg pointed me to erlaunch, a kind of erlang scripting environment where the VM runs in the background and dosent need to be restarted for each script. So I guess something along that lines is the way to go for TextMate Erlang integration, probably a TextMate plugin written in C which takes care of the Erlang background VM during TextMate uptime. Need to learn now how to write a TextMate plugin ...

s3fox - a great Amazon S3 explorer and backup tool

I recently had to do some disaster recovery on my mac and made the painful experience that mozy sucks in every way one can imagine. After several failed attempts I managed to restore most of my stuff. Ok, mozy mac version is still in beta, and it is dirty cheap but it is also completly useless for the less experienced user, because it was not straight forward for me to restore large sets of files and it is useless for the more technical user, because it gives you little control of what it is doing and you can't even backup hidden files (e.g. a git repository) and when I asked them about that, I just received a non-answer from somebody who did not understand what I asked. This is my personal experience. I am sure there are plenty of happy mozy users out there.
So I had to reevaluate my options for personal backups. Because I was already a heavy user of Amazon S3 in relation with various web projects, I tried out some of the common S3 desktop tools:

• JungleDisk (commercial, cheap) - sucks because what you store with JungleDisk you can only retrieve with JungleDisk (with additional effort you can do anything of course).
  
• S3 Browser (free) - sucks because there is only a mac version and it has very limited functionality.
• BucketExplorer (commercial, free while in beta) - sucks because it is written in Java and therefore looks ugly and just feels strange on the mac.
  

It's a crowded market and there are a lot of other S3 explorer and backup tools out there. I actually had been using one heavily and with great success when it came out: s3fox. It's a slick Firefox extension and it was the only one which exactly worked the way I actually expected it to work. But there was one problem: after initial release, the author did not maintain it, and Firefox evolved, the S3 protocol itself evolved and when I switched to a mac half a year ago, I couldn't use it anymore (I don't remember for what particular reason). Now I checked again and - nice surprise - there is a new version (0.4), which solved all the problems and even got drag & drop and some functionality for synchronizing local and remote folders. Easy to install, easy to use, free. I didn't have to look any further.

MochiWeb got a HTML parser

Since MochiWeb went open source I have been working with Tait Larson on a Comet server (HTTP push) built on top of MochiWeb. We are not there yet, but it has been a very pleasant experience so far, especially considering an earlier (failed) attempt of mine to build such a thing on top of yaws, where I had to patch yaws and deal with all kind of annoyances (don't get me wrong, yaws is great for 99% of all possible use cases, just HTTP Push belongs to the other 1%).

So today I was just doing some online housekeeping and I noticed that MochiWeb got a HTML parser. Thats great ! So far, it has been asked many times on the Erlang mailing list how to parse HTML. And sooner or later somebody points to the yaws HTML parser, which works reasonably well. One time it was me asking that question and when I got the answer, I started to play with that yaws HTML parser and some simple XHTML (if I remember properly) examples and everything looked fine. But things turned nasty when I tested the yaws parser with real world HTML.

Now I hope people are starting testing and crashing (I just did) the MochiWeb parser with real world HTML and provide feedback to the developers so they can further improve it !

Rounded corners with canvas tag graphics

There exist many different approaches for creating rounded corners on HTML pages, and each of these approach has its problems. Javascript based solutions consume too much CPU cycles (and even more if doing anti aliasing), background-image based solutions are complicated (and even more, if done properly, e.g. sliding-doors based) and involve additional HTTP requests and solutions based on a bunch of DIVs (with border and varying margin to emulate the corner radius) turn any page into a horrible tag soup. The slickest solution, with the cleanest HTML and Javascript code I have seen so far is Greg Houston's mocha. It uses the canvas HTML tag, which is supported by Firefox, Safari and Opera 9. The ugly part of this solution is the heavy work-around required for Internet Explorer.

Amazing browser-based Javascript IDE

A few months back I put together a summary about browser-based Javascript code editors. Then I tried myself to create one, with dojo, but I did not get very far. Then Nicola Rizzo released CodeTextArea, which is a dojo widget and a very promising approach. A demo is available and it currently best works with Firefox on MS Windows. Today I learned about TIDE, a full fledged browser-based Javascript IDE, which loads fast, looks amazingly good, provides a lot of typical IDE functionality and has even a bunch of working Javascript demos to play with. It uses the following open source libraries:

• ExtJS for the GUI
• CodePress for the Javascript Editor
• Narcissus (from Brendan Eich) for Javascript parsing

The webhosting reviews of the different hosting companies give very informative and useful details about their hosting packages. The basic aim of seo services is to provide all essential tools of search engine optimization to enhance the web ranking according to the criteria of main search engines. The domain registration service providers offer very affordable rates for registering domains. The one of most leading hosting service providers, dotster has been offering very reliable hosting packages for the potential clients in reasonable ratings.

Amazon S3 will soon support upload via HTTP POST

One limitation of Amazon S3 is its strict REST behavior: upload only via HTTP PUT, and that is not possible with most of the browsers. Today a proposal was published by Amazon staff, so the final solution is probably not too far away anymore.

Easy Erlang compiling with TextMate

Today I created a custom command for easy Erlang compiling with TextMate. Errors (if there are any) are popping up hyper-linked on a HTML window, and if you click on them, you get straight to the file and line with that error.

• Download: Erlang Build command
• See it in action: Screencast (Quicktime, ca. 4 MB)
  

This is work-in-progress and just compiles the current file. The following features will be added in future versions:

- only compile modified files
- parse Emakefile if available, otherwise:
- crawl directories to figure out src, include and ebin folders.
- code reload if node is running

Which Javascript library ?

Update: Simon Willison's Javascript library slides, which where embedded at this place, are not accessible any more, so I took out the embedded slide show.

If it is just about pepping up a webpage with some AJAX and some flash-imitating eye-candy, any of the popular Javascript will serve similarly well. But when it comes to full fledged web applications, the dojo toolkit is leading the pack. Vance Dubberly shares the same vision and today he has provided a detailed answer on the dojo mailing list, why he is choosing dojo:

Because it's an application development framework. Most of the
javascript libraries out there serve some special purpose, Ext is a
gui toolkit, Prototype is a util library, and everything else is
pretty much the same. Dojo holds a special place in the community in
that it provides a unified framework for developing applications in
javascript. What I mean by this is that it provides everything from
simple utility classes to full implementations of design patterns.
Dojo helps me organize my application layout, debug it's output, and
prepare it for distribution.

Drawbacks? The most glaring one is the horrible documentation. It's
gotten a lot better but it's still neither consistent, clear, nor
complete. The documenters are working mostly API style docs. The dojo
book reads like a brick wall. The project is badly in need of some
"Here is how to accomplish (X) style docs" Despite this the pay off is
high for those who invest the time and suffer through the exponetial
increase in 4 letter words coming from between their lips.

The widgets are a nice bonus but I gotta tell you I used it before .9
and wouldn't touch the widget system because it was heavy, slow, and
well, annoying. ( no longer an issue ) It has much to offer beyond
widgets. Take a look through the dojox directory ...

Large file sizes aren't really an issue anymore, and what's better is
that you can if you choose, optimize your builds to include only what
you want in the dojo.js file.

Oh and one last thing, a thing which I think is often overlooked. The
Dojo foundation isn't simply building a javascript library. They spur
and drive innovation in the community often developing or incubating
break through technology. This kind of behavior deserves to be
rewarded.

First step in adapting Textmate for Erlang

I have been using Textmate for two weeks now, for all my coding needs, my productivity has increased (I know, all the real good programmers use Emacs or Vim, so I am not one of them). Today I spent some time on starting a little side project: improving Textmate Erlang integration. I have created templates with skeletons for a general Library module and also for the the following OTP behaviors:

• application
• gen_server
• gen_event
• gen_fsm
• supervisor
• supervisor_bridge

The module header details such as author, license, etc. can be specified via environment variables.
There is a long way to go, to create a complete Textmate bundle and reaching an Erlang integration as provided by Emacs. If anybody wants to join, you are welcome. An feel free to use the templates and adapt them to your own needs:

Download: Textmate Erlang templates

Note: if you set environment variable TM_MY_LICENSE to "MIT", then the MIT license gets included in the header as comment (more open source licenses to be added). Other custom environment variables I use: TM_MY_EMAIL and TM_MY_WEBSITE. You can set them in the preferences.