Simon Willison’s Weblog

High security is low security

Via Crypto-Gram, a great piece from Bruce Tognazzini about how tough security measures can actively reduce the security of a system:

Analysing methodologies

Joel Spolsky on analysing development methodologies:

An apology

It turns out that the Javascript on PHP.net mentioned previously was not deliberately obfuscated to protect the code from prying eyes; it was merely compressed to reduce the size of the script. See this comment for further details. I’d like to apologise to the maintainers of PHP.net for jumping the gun on this issue. Incidentally, the unobfuscated code is now available in CVS.

Click Maps

I’m not a very visual person; complex entity relation ship diagrams, data flow diagrams and the like are usually completely lost on me, and I try to avoid them when they are mandated by coursework at University. Give me a text based SQL schema any day. Click Maps on the other hand I could learn to like—they’re nice and straight forward and solve the very real problem of planning how different parts of a web application will link to each other.

The good and the ugly

PHP.net has a new feature on their search page—a really nice implementation of an auto complete text widget in Javascript. Even better, the search page is valid XHTML 1.0 Strict and uses CSS for the layout. Let’s hope this is an indication of things to the come for the rest of the site, which still mostly consists of tag soup.

Extracting EXIF data with Python

I’ve been rewriting the photo gallery management system for KUSports.com in Python. One of the new features is that the system can automagically extract caption and photographer information from the photos, provided the information has previously been added to the jpeg file as EXIF data. I tried several methods of doing this but eventually settled on EXIF.py because it worked straight away using a simple process_file() function and doesn’t require any additional software. Recommended.

Easy installers for PHP scripts

I tried out FUDforum last night, after Rasmus Lerdorf recommended it in a comment on Jeremy Zawodny’s blog. Feature wise, it’s pretty impressive but still doesn’t quite do it for me—I want something that’s trivial to integrate with an existing authentication system and outputs valid HTML (or XHTML) out of the box. Rasmus says it’s the only board he’s seen that doesn’t have obvious security holes though so it’s probably worth checking out if you need to set up a forum of that kind.

The little things

We put together a bookmarklet today that allows our editing staff to jump instantly from looking at a story on one of our web sites to the interface for editing it within our current content management system. It took about 5 minutes development time, plus an extra 15 minutes spent showing it to people, setting it up on machines and demonstrating how it works. It’s hard to over state how well this new shortcut was received by the people who spend hours every day using the system. For end users, a little feature can sometimes go a very long way.

Roundup of roundups

There’s blogging a list of links, and then there’s blogging a list of lists of links:

More required reading

Via Craig, Big John and Holly Bergevin present Float: The Theory and Flowing and Positioning: Two Page Models. Both articles take a complex topic and present it in clear, straight forward terms with excellent illustrations and the kind of insight in to browser bugs (in particular the vagaries of IE) that you just won’t find anywhere else.

Browser testing utopia

Innovation chez Orchard

Dunstan Orchard’s great looking blog has had a whole bunch of upgrades, and some of them are pretty interesting. Firstly, he’s taken my blockquote citations script and modified it to handle citations that aren’t links in an intelligent way. He also now has a comment spam blacklist (I really need to work out the syndication details for that and publish some code).

Full page zoom

For as long as I’ve understood the issue, I’ve been an advocate of liquid layouts over fixed widths for web page design. Liquid layouts are layouts like the one used by this site, where the page adjusts to fix the size of the user’s browser window. Fixed widths on the other hand are sites such as LJWorld.com where the width of the page is fixed no matter how large or small the browser window gets.

Multiple Internet Explorers

In possibly the best news web designers will hear this year, Joe Maddalone of Insert Title Web Designs has discovered a way of running multiple versions of Internet Explorer on one installation of Windows! The problem of testing in different versions of IE has plagued developers for years, and it’s fantastic to see a solution that doesn’t involve running multiple partitions with separate Windows installations or shelling out for VMWare or VirtualPC.

Usability guidelines available online after all

In an earlier entry about Usability.gov’s Research based Web Design & Usability Guidelines I criticised them heavily for not providing an HTML alternative to the huge PDF file containing the guidelines. It has since been pointed out that the guidelines are in fact also available as HTML. I’d like to apologise to the authors of the site, although I would also like to suggest that they add a link to the HTML version from the PDF page. Thanks go to Adam Bramwell for alerting me to my mistake.

easytoggle and debugging in Safari

I’ve been working on a new inobtrusive DHTML effect: easytoggle, which is an inobtrusive implementation of the common effect where links or tabs can be clicked to reveal part of a page while hiding the other parts. It’s similar in some ways to the Multi part forms with Javascript technique.

Javascript Mojo

Stuart Langridge has released a couple of very neat new Javascript experiments. sorttable makes any data table on a page “sortable” by clicking the table headers. I’ve seen this effect used to demonstrate Microsoft’s proprietary “behaviors” technology but Stuart’s solution has the advantage of being standards compliant and working across different browsers. Best of all, it follows the principles of inobtrusive DHTML and hooks in to the markup using only a class attribute.

Web design and usability guidelines

Usability.gov’s Research-Based Web Design & Usability Guidelines lose instant credibility for being available only as a 39.2 MB PDF file [ Update: this statement is incorrect—see my correction ], with all of the usability and accessibility problems that brings with it. I’m on a fast connection here so I downloaded them anyway to have a look. There’s actually a lot of good things I can say about them—the document is attractively laid out, the guidelines clear and easy to follow and each is backed up by references to academic research (hence the title). There are however some guidelines with which I completely disagree, in particular the ones in chapter 4, entitled “Hardware and Software”:

That G5 Cluster

Confessions of the World’s Largest Switcher is the best coverage I’ve seen to date of Virginia Tech’s 1,100 Dual G5 Mac cluster, now the third fastest supercomputer in the world and built for a fraction of the price of its rivals. Mac Supercomputer Just Got Faster on Wired has some more information.

Halloween Decorations

Spotted so far:

Shooting yourself in the foot

Kimbro Staken on DRM: The record companies can be proud that they’ve so thoroughly screwed things up that there really isn’t even any point in paying for music now.

Nvu

Launched today by Lindows, Nvu is a new project to develop a complete “web authoring system” (aka Dreamweaver/Frontpage style WYSIWYG editor) for the Linux platform. Reading around the marketing hyperbole, What it actually is is a standalone version of Mozilla’s Composer with a whole bunch of improvements and extra features, scheduled for release in early 2004.

Defeating browser incompatibilities

Peter-Paul Koch has unveiled his new site, QuirksMode.org, which features over 150 pages of cross browser CSS and javascript tips and tricks. Five months in the making, there’s just too much good stuff to link to individual pieces here so my best recommendation is to head on over there and spend some time browsing around. I’ll make an exception though in linking to the Table of Contents script, which uses the DOM to create an additional navigation bar linking to each of the level 2 and 3 headers on a page. Another great example of the power of structural markup.

Getting my stripes

Well colour me yellow and black, I’ve just become the latest member of the web standards project! I’ve been an avid supporter of the web standards movement for over a year now—in fact, my first ever entry linked to their launch of Phase II. It’s a great honour to be a part of something I’ve supported for so long and I hope to become heavily involved in the Learn campaign, which aims to provide resources to developers who want to learn to use web standards effectively. I’m joining a truly talented team and I look forward to helping encourage web professionals to adopt standards and make the web a more interoperable place.

PCs for non-geeks

A couple of interesting links about the security problems faced by the vast majority of the home PC using public, who don’t know how to install security updates (or even what they are) and don’t have a corporate IT department to bail them out when they run in to problems. Joe Average User Is In Trouble is a column by a security expert bemoaning the scale of the problem. Do we all need a personal system administrator? is a call for advice from Steve Garrity for tips on minimising the support calls he gets from his parents, and includes an excellent response from Matt Haughey in the comments.

Optimising Python

Some great tips for optimising Python, courtesy of Ian Bicking:

Avoiding RSI

I’m pretty sure I’ve never had RSI, but occasionally my wrists feel a little sore after spending time at the keyboard and I know enough about it to know that I really don’t want it. This weekend I started using WorkRave after spotting a link to it on Meri’s blog. It’s a neat little application for Linux and Windows that sits in the background and reminds you to take short breaks from the keyboard every once in a while. Following the suggestion from the FAQ I have it set up to encourage a 15 second “micropause” every 10 minutes and a 5 minute proper rest break once an hour. It’s too early to stay if I’ll stick with it or get annoyed and turn it off, but I have to admit that I have been feeling a bit more comfortable at the keyboard. Whether that’s purely a psychological effect from using it or the breaks are actually making a difference is hard to tell.

Capturing the power of re.split

A couple of Python tips. The first is really a tip for Mozilla/Firebird: You can set up a Custom Keyword for instantly accessing Python module documentation using the string www.python.org/doc/current/lib/module-%s.html—I have this set up as pydoc, so I can type pydoc re to jump straight to the re module documentation. I only set it up half an hour ago and I’ve already used it about a dozen times.

XUL in Safari

Safari 1.1 is included with the new release of Mac OS X, Panther. From Dave Hyatt’s list of Safari 1.1 features:

The difference between POST and GET

How important is the ability to tell the difference between data sent by POST and data sent by GET (i.e in the query string) when developing web applications? Some web frameworks (such as PHP) provide separate mechanisms for accessing POST and GET data. Others (such as Python’s cgi module) provide a single interface to form information that doesn’t distinguish between the two. I already have a strong opinion on this but I’m going to leave it open for discussion here for a bit before weighing in.