Web Service Based Web Sites

Web Services (ws) and Web Sites have many things in common. So, why not put them together? I gave it the classic "Jared try" to find out if I could. (http://blueblocks.lobberecht.com)

DB <-> Business Logic <-> Web Services <-> Web Browser

First, I had to make some allowances for the Web Browser. No browser, that I know of, will directly communicate with a ws. Browsers were designed to use pure HTTP. My solution was to create a PHP file to act as a ws proxy for the browser.
DB <-> Business Logic <-> Web Services <-> PHP proxy <-> Web Browser
(I used PHP because my host only supports PHP. You could accomplish this in any server-side language, perhaps even a client-side language, that has a ws library. I also used PHP for the SOAP webservices.)

I chose not to output HTML from my ws. HTML was designed to describe the look-and-feel of data, not content. My ws outputs standard XML, conforming to various specifications, based on the content (RSS for the News, etc.), to maintain it's programmatic accessibility and compliance to accepted standards. I still had to contend with the browser, because it is still a web site, so, I used XSLT to transform the XML into XHTML on the client side. The client side XSLT transformation does limit my audience to modern webbrowsers, such as IE6 and Firefox, but I'm not trying to make this site universally compatible. Besides, you should be running a modern browser for security reasons anyway.

Advantages:
None. There are no advantages, in this design, over having an HTML page and a separate XML page, expressing the same content, generated directly from the same datasource. I have, simply, made the conversion process, from data to HTML formatted response, serial. (DB->XML->HTML) Some would also consider this a weak point in the design, because the HTML is dependent on the XML and the DB instead of just the DB.
This might be a good design if the site is intended to be used programmaticly, with a fall-back to HTML for those who wish to use it that way.

Disadvantages:
A little more difficult to code, especially if you are already using a CMS or other HTML based template engines.

Tips:
Anyone returning XML from a Web Service should remember, the XML validator that validates the ws response will strictly validate your returned XML also. Make sure the returned XML is valid, has the <?xml version="1.0"?> tag, and a DOCTYPE or the whole ws response will not validate. You can also use a CDATA tag to enclose the response, but that did not work for me.

GeoURL

Google-depression strikes again!

GeoURL is a location-to-URL reverse directory. This will allow you to find URLs by their proximity to a given location. Find your neighbor's blog, perhaps, or the web page of the restaurants near you. It currently only lists 181,117 sites, but you can add sites for free.

When mobile internet devices incorperate GPS devices, businesses will want this!

Super Future Prediction: This idea will be officially folded into Google Maps. (Unofficially, It has already been done by Leigh Dodds.)

Code Signing on a Shoe-String Budget

I don't need a professional Code Signing infrastructure complete with 24/7 Indonesian support and free Hot Pocket delivery within the tri-state area. I just want to make sure people know they have something of mine for less than, or equal to, $0.

Solution 1 of 1:
Free code signing. (I must remind everyone of the lack of official support for what I'm about to describe. If you are running a real business, go pay the money.)

Requirements:
Windows (I'm using XP)
Compiled binary of OpenSSL
GlobalSign's PVK transform utility (Mirror)
Microsoft's code signing stuff (Mirror)

Steps:
Get a free certificate from Ascertia.
Note: The "Name" you enter will be the name seen on the certificate. Don't worry if you can't decide on a good name, you can change it after you register.

Generate and download the certificate using Internet Explorer.
It failed to download the ActiveX file in all the other browsers I tried, including Firefox.

Run certmgr.exe from codesigningx86, select the certificate, and export.
Select the option to export without the private key and in DER encoded binary. I did not test the other encoding methods, but, in theory, they all should work.
This should produce a cer file. I put all my files on the desktop to shorten all the path names. There is nothing worse than typing and searching for errors in long pathnames.

[I had a beautiful tutorial written just before the power went out. For speed, I will just give you the bare bones.]

cert2spc <insert cer file path> <insert new spc file path>

Run certmgr.exe, select the same certificate, and export again.
This time export the private key. Make sure "Include all certificates in the certification if possible" is checked and "Delete the private key if the export is successful" is unchecked.
This will export a pfx file. (Make sure to remember the password you set.)

openssl pkcs12 -in <insert pfx file path> -nocerts -nodes -out <insert new pem file path>

pvk -in <insert pem file path> -topvk -out <insert new pvk file path>

You only need the spc and pvk files, so you can, and should for security reasons, delete the other data files.

signcode -spc "<insert spc file path>" -v "<insert pvk file path>" -a md5 -i "<insert some information, usually your websites url>" -n "<insert short file description>" -t http://timestamp.verisign.com/scripts/timstamp.dll "<insert target file path>"

You don't have to pay Verisign to use their timestamp server. You should, and again you should just pay the money if you are running any form of business, but it works whether you do or not.

That will do it. You can verify the signature by opening the properties of the signed file, and clicking the Digital Signatures tab. If there is no Digital Signatures tab, you failed.

Thanks to Matthew Jones for the help.

Crazy Idea #2

For those who have never met me, let me give you a small window into my creative process.
I see the future as a combination of current technologies. My logic is simple. You build new technologies off of different seeds, and hope you come close to the core or the leaves of the tech-tree that results. (That's where the money is.) You either form the core, by controlling the growth, or form the leaves, thus servicing everyone outside of the tree. ($$$)

I start by taking an accounting of all the "Buzz-words" floating around, past, present, and future. All three types are important. While we don't talk about those legacy acronyms anymore, at their core are ideas that can ground your perspective. This is very similar to brainstorming, idea mapping, and those nifty one sentence pitch lines writers give producers. ("It's Knight Rider meets Lassy.")

Here's what came out of the idea machine: "Distributed" + "Website" + "Firefox". I was about to write a program to randomly join buzz words before I came up with this combination. Translation: A Firefox extension to combine the distributed ideas of Bittorrent and Freenet with standard websites. The purpose is to stop all those people bitching about their websites being inundated once their urls are published on Slashdot. For those needing further explanation, clarification, conglomeration, identification, justification, and enumeration, I will continue. (Don't get the joke? See Alice's Restaurant. Still don't get it? It was a bad joke to begin with. Consider yourself a good judge of humor.)

The idea is to use your internet browser's cache as a source for other surfers to draw from, instead of hammering the server with constant identical requests. Thus distributed the load currently required to publish a website over the number of people visiting and people who have previously visited.

Positive: It would be an immense boost to Mozilla when server operators and companies advocate the use of Firefox, instead of Internet Explorer, to reduce their network load and cost. Peer-2-Peer applications would be seen as having a positive application. And, in general, I would learn about Mozilla extensions and brush-up on my C++.

Negative: While the system would initially reduce server load, it would increase general network load and increase page loading time. Page updates would also have a propagation delay causing untimely, and incorrect, data. Dynamically generated pages would also fail to benefit from the bandwidth savings due to their transaction-based nature. Security minded individuals would be opposed to a server giving away their IP address, like free candy, to all who request a file. With a little data processing, it would be an even shorter jump to link users to webpages then with current systems.

Quote of Inspiration: "We choose to go to the moon. We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard, because that goal will serve to organize and measure the best of our energies and skills, because that challenge is one that we are willing to accept, one we are unwilling to postpone, and one which we intend to win, and the others, too." -President John F. Kennedy

Quote of Caution: "Paper lends itself well to fundamentally flawed ideas, such as Communism." -Unknown Author

Idea rank: 3 of 5

Life after ZoomFolder

I have now released ZoomFolder 1.0, my simple ZUI experiment. But, what do I do now?

I could buy some clothes. Clothes make the man, and all I have are T-Shirts. What does your wardrobe say about you?

I could work on my resume, and get a job. Getting a job would require nice clothes. Thus, this would be a three part task, resume, buy clothes, and then the jobs will roll in.

I could go back to school. A step that would require the GRE. While hardly insurmountable, it is still a hurdle. And what about all the busy work, all the exams, and homework? Could I still put up with them?

I could start-up another fantastic project A project management, a software bug reporting, or a peer-2-peer TV solution would be nice. I would also be nice to have all three. But what good are these projects if I can't sell them?

I think I may just flip a coin.

I also wonder why people advertise urgency on rentacoder.com when bidding doesnot end for two weeks. I guess it's just not urgent enough to pay a professional coder.

Pad The Wonder Notepad

I have a fascination with HCI. It is an uneasy marriage of computer science and psychology. Some would go so far as saying it is streamlining the interface between two computers. I don't care about that. I want to make my applications better. I want the Six-million dollar man of applications.

I was reading some HCI articles and forums a little while back and came upon a repeated quandary. "Do we really need the Save button?" No one's arguments were very persuasive, but the idea held promise. So, I did what I always do. I tried it.

Pad
A notepad replacement designed without a user accessible save or open command.

When I started this project I only wanted to axe the Save command, but, upon further consideration, I noticed the Open command was equal in utility. Thus, it was open to the same question of importance.

Now for the big question. If you have no save command, when do you save? Saving to often, while supremely safe, wastes resources and accesses the disk irresponsibly. The scenario of a publisher saving a four MB document on every keystroke shows an extreme of this.

The traditional answer is to use a countdown timer. Every thirty seconds, one minute, or some user set time the application saves. Time-based saving is a good solution, proven by the relief you feel when you find MS Word saved your document for you before a program crash, but how do you determine a good time interval? If the interval is to long, the user loses everything they've typed since they last manually saved, which is usually everything. With a short interval you encounter the same argument for saving to often, wasting system resources and over-burdening hardware.

A second solution is to derive a save-point from the language itself. "Separation characters" are built into most languages. The punctuation characters could be used in English applications. In normal word processing situations the punctuation characters would be ideal, because they are numerous in documents and, yet, not so numerous as to over-burden the hardware. But, the extreme cases must be considered if you are removing the user's ability to manually save, such as lists or the lack of a punctuation character in the document. (I admit this is a very rare case.)

Also, the saving method needs to be tweaked to only save differences, and compensate for the write buffer size for efficiency.

My solution is to combine both and add major window events, such as minimize and close, into the saving strategy.

The open command is taken care of by Windows, but causes one problem. If the user wants to jot something down they need to create a document first. This might force users to organize their documents or just create more excess documents. Since the latter is more likely, I created a default save file. A centralized text file for all the unorganized, untitled, and unrelated notes. There is potential for abuse, but it's inclusion is worth more in terms of user convenience.

That was easy. Now, why isn't everyone doing it?

Teaching Computer Science

I helped a Geology major with a computer science project the other day. It was a very taxing, and yet eye-opening experience. From my prospective computer science is natural. The demand for structure parallels literature and engineering. And yet English majors and Engineering majors, not to mention Geology majors, can't program computers.

First, and foremost, I can assure you of the existence of willing students. Many equate this with Bigfoot and Nessie, but I have seen them. (My friend even has a blurry photo of one.)
The more plausible explanation is the difference in perspective between professors and students. Most professors have ten, or more, years in the field of computer science. They think in code. They dream in code. And, quite logically, they teach in code. There exists almost a mutual dependency between a programming language and the abstract consepts it is used to express. A circular bridge if you will.

A picture is worth a thousand words. So why don't we use more pictures to teach abstract concepts? Formalized software engineering methods are real and use simple symbols such as clouds, squares, circles, diamonds, letters, numbers, and arrows to explain absolutely everything. They could be used to teach the concepts of computer science instead of computer languages. New students would gain a "Big Picture" perspective over what the program is doing compared to a line by line code example. Similar to concept mapping.

How to solve a problem is a problem still waiting to be solved. I asked the girl what would be the general process of averaging up the grades entered by the user. She did not have an answer. Schools are supposed to teach this from day one. In the end, I just did her project for her.

I wonder if this could be applied to other forms of language. I can see it now, "Learn French via UML".

Google Desktop Search Reveals Security Apathy

In an article dated yesterday, PCWorld cast Google Desktop Search as the invader stealing and copying secure information. (Does Google Desktop Search pose a risk?) Is that the real question we should be asking? Halt your pondering. The answer is no. Google only finds what is there. The question should be, "Why is all this private data there?"

Good security is hard. Hard to use. Hard to implement. And hard to sell to email-using grandmas. This explains the prevailing attitude of "If they don't know where it is, they can't find it". This, easy to implement, type of security is called "Security by Obscurity" and has been proven as secure as having no security at all. If your secure web-based bank transactions are available via GDS, blame your web-browser for saving it, or yourself, in some circumstances, for not turning on a security feature.

GDS has not created a problem. It has revealed one.

Regex

I can't believe I lived this long without knowing Regular Expressions. Note to all computer people: Learn Regular Expressions! It's one of the most useful tools you will ever find.

What is in a name?

Have you ever used iterative problem solving? If you don't know the term, you just did.Iterative problem solving is an amazing process to breakdown unknowns into known chunks and repeatedly connect them with known chunks to understand and solve the initial unknown.

Here's an example:
What does a "trash can" do?
A Can is a known object. Cans are usually metal objects, similar to bowls, with a lid.
Bowls are objects made to contain items. Like plates with the edges turned up.
Plates are... and so on.
Trash is also a known idea. Trash is a term which denotes another object as undesirable.
So, a "trash can" contains or holds undesirable objects. Simple.

What about a "Firefox", what does it do?
The software industry is notorious for marketing geniuses obsessed with cleaver and abstract software names. (Nero, Trillian, ABC, Fiddler, etc.) Names that seem independent from the function of the tool they are hawking. And I say tool because that is what software is. Software is written to help facilitate other actions. Nothing more.

Naming software is very important. Sales depend on your choice.
A simple, but effective, way to gauge the quality of a name is to look at it from the point-of-views of different levels of users. Does the name communicate the purpose of your tool to different levels of users?

XMLSpy
Scenario 1) I don't use computers. So, I don't care what you nerds are cooking up to produce your porn. (This guy usually doesn't matter, but he maybe connected to people who do use software.)
Scenario 2) I am an average computer user and I don't know what it is. Using iterative problem solving, to break down the unknown name, it reveals XML and Spy. I don't know what xml is and I can't break it down any further, but it's a TLA so it must be a computer term. Since I've seen James Bond, I know what a spy does. So, my conclusion is XMLSpy goes out and spies on other people's xml, and maybe if I get the professional version it will sabotage those evil-doers using xml. Because, by the iterative process, xml is evil and must monitored, controlled, and stopped at all cost.
Scenario 3) I am a computer tech trained to help other users and I don't know what it is. Again, I break it down into XML and Spy. I know what xml is, but I have no idea what it is used for. So, I don't see a reason to have to spy on it. But, if the paycheck says it's important to spy on xml they must have their reasons.
Scenario 4) I am a developer and I don't know what it is. I break it down into XML and Spy. I use xml, and understand why it needs to be protected, and I've heard, or used, programs that "spy" on computer usage. Thus, my conclusion would be this piece of software monitors the use and modification of a company's xml data.
Scenario 5) I know the product and must spend a good chunk of time explaining, to someone else, how XMLSpy does not spy or your xml data.

In 5 out of 5 scenarios the name XMLSpy is ineffective in communicating the purpose of the software. Even if you are targeting developers and known users (Scenario 4 and 5), the lower levels serve a disseminating role. I found winamp through a football player. (You can't fight the six degrees of separation.)
Additionally, a good name should follow these rules for broader marketing reasons: http://www.abcnamebank.com/GoldenRules.html

Bad Examples:
Access
Acrobat Pro
Aimster, Madster, Sigster, Sexter, NeoNapster, Grokster, and Napster
Alcohol 120%
BlackIce (This one is running right now, and I know it's important, but for the life of me I can't remember what it does.)
EyeBatch
Excel
GIMP
The whole Macromedia line minus Freehand (http://www.macromedia.com/)
Novel
OneNote
Outlook
SLOX
sux
XFire

Take a moment and read over those names. Can you figure out what any of them do without running them first? Without someone out right telling you what each one does?

This is why I like to say, "Name Everything Like A Kitchen Appliance". It toasts things, so it's a Toaster. It mixes stuff, so it's a Mixer. Use iterative problem solving on "Dish Washer" and you get exactly what the tool does. No ambiguity. The name might not be trendy, and may sound funny, but the user will know exactly what your product does before he or she buys it. And that means higher sales and free user experience points.

So, what is in a name? Your future.