Women Who Tech TeleSummit

June 9th, 2009 by comment jenlindner

The Women Who Tech TeleSummit was like a gift that just keeps giving, and giving and giving. I attended three and a half panels and the after-party and discovered about twenty progressive, interesting businesses, news organizations, non-profits and email lists. Quick disclaimer, I love this stuff more than I love technology. I could eat ten progressive new developments in social justice for breakfast, every day. So my cup of tea may not be your cup of tea, but the fact that all of this is made possible by the agile new web technologies that devchix and women like us are building has got to be common tea. Eh?

Let’s start with the Launching Your Own Startup panel. The quote I can’t stop remembering is “Entrepreneurship is like jumping off a cliff and building a plane on the way down.” Also, that failure has lots of virtues: it makes you smarter, more attractive to funders, can make you fearless and more willing to jump that cliff. They all heartily encouraged anyone interested in starting a business to go for it. On a practical level, they all made sure their ideas had legs before quitting day jobs or abandoning previous businesses. They recommended an iterative business model with some focus on revenue from day one; recommended bootstrapping then going for advisors and then angel funding before going for VC money. They stressed researching VCs very, very thoroughly to make sure they understood your product and market or community, then selecting one you have a viable, personal connection with. They also recommended having business partners, for the value of differing strengths, but also because it makes you more attractive to funders, helps with your power balance with them. They all recommended Steve Blank’s book Four Steps to the Epiphany.

The next panel I attended was called The Feminine Mystique. (See this for the historical context of that title.) Essentially, this one was about the level of satisfaction women are finding in the life of technology work. Issues of work/life balance, of qualities of nurturing being undervalued in the workplace were explored. —There was a nuanced discussion at this point, by the way. We recognized that not all women are nurturing, etc. The value of mentoring was explained thoroughly, however, both in the men-tee experiences of the eminently successful panelists and as an undervalued management tool used to grow workers. We discussed promoting tools for shared parenting and increased time off for fathering, that had been introduced twenty years ago and were succeeding but lost favor in the rabid conservatism of the past decade – job-sharing, for example. We discussed the need to consider ourselves experts with less qualification than studies show we currently do, to create more parity with the way men determine themselves experts, and then act on that accordingly. (Men will see a list of requirements for a job they’re interested in, know they have only two out of twelve, for example, and confidently apply; women won’t unless they have ten, for example.) I feel however, that a little of both is in order on this issue: it’s important to re-define “expert” so that men who may be undeservedly claiming the right to that title are discouraged, just as it’s important for women who aren’t doing so to be encouraged. This translates into behaviors like speaking in meetings, etc.

The Video Activism panel. The panelists were from Youtube’s non-profit program, Witness.org and Free Range Studios. Basically they discussed different methods of persuading people to act, but their relationships to video were very different. I thought the most interesting aspect of the discussion was the striking contrast between Witness’ and Free Range’s work specifically. Witness is a global human rights organization, while Free Range is a San Francisco-based design shop that provides creative services for nonprofits and socially responsible companies. Witness often works with user-uploaded video, it’s often brutal and they don’t necessarily have control over issues of style or sound or pacing, whereas Free Range is in the business of crafting and producing video as part of larger, sophisticated campaigns. Both are very effective organizations, both discussed tactics for targeting people in concentric circles from most passionate and likely to act to least aware and engaged, but with widely differing parameters. Witness gave an example of a very graphic video in which Egyptian police beating a man was produced and released by the police themselves in order to intimidate others, but it reached the notice of human rights bloggers and so has been widely used as a resistance tool. It’s this combination of raw footage used by bloggers that creates the successful activism in Witness’s case. (Witness licenses footage on a sliding scale from their archive of about 3,000 hours of video; it’s frequently used by documentary filmmakers, journalists, grad students, etc.) Whereas the Free Range spokeperson gave an example of using stop-motion video, which is time-consuming and a little expensive to produce, in a campaign called save the bay. It was also very successful: they achieved their targeted number of email signups and their funding goals for an environmental impact study. But they were able to control every aspect of the video and the microsite on which it’s viewed.

I listened to a bit of the Social Media ROI panel, which hit topics like how you measure success depends upon how you frame your criteria, slightly tautological but the example given illustrates the power of the point. Presidential candidate Ron Paul used social media to try to win the Republican party’s nomination but didn’t (obviously). What they proposed, I believe based on interviews with Mr. Paul, is that he didn’t believe or intend to win, though of course he would’ve welcomed that outcome. What he wanted was to make sure certain issues were part of the debate and by using social media, he achieved exactly that. And hence, success. I only listened to a bit, though, because I was getting ready to travel to the after-party, which I attended and thoroughly enjoyed. The bar was laid back, they provided meat, vegan & veggie pizzas, it was a comfortable number of people, the discussions were friendly, and I met a journalist who works for the Huffington Post. On top of meeting five or six women programmers and Deanna Zandt, a prominent feminist organizer and technology consultant in New York who turned out to be one of those really nice, fun, shots-for-all-buyers. Good times, chix. Maybe we should try to get involved with next year’s summit, as an entity. 

Links:

Women Who Tech Podcasts

Witness

That’s Not Cool

Knight News Challenge

RAD Campaign

Now Public

Deanna Zandt

RiseUp

The Story of Stuff

Free Range Studios

Berrett-Koehler Publishing

ˆ Back to top

Love, Software, and Squeals of Delight

March 23rd, 2009 by comment sarah g

Dock

Software does more than crunch your numbers or take your picture: it can make you angry or bring you joy. And those are the things that we, as developers, have to tune in to if we want to make our products stand out.

Skitch is one of a handful of products I’ve used recently that remind me what makes a product successful. Utility is important, of course, but the love and emotional connection it engenders in its users is where it’s going to live or die.

Let’s start backwards, with the logo, since it’s the first thing you see. Their logo says nothing about their product’s functionality. There’s no initial, no recognizable signifier (thanks for sparing us the paintbrush), or even an abstract swoop. It’s, um, a heart.

And not just any heart, but a hot-pink, shimmering, pumping, overflowing, disco heart.

They’re not saying, “You might like us”. Or even, “As you can see by the ‘S‘, we’re Skitch”. They’re saying, “This is LOVE, baby!”. You and me!!! (How they’re managing to do that without coming across like Mr. Roper, though, is a mystery that is beyond the scope of this post.)

Now, this Love they offer, it’s not too intense. It’s not Valentines Day Red. It’s not a pushy “when are you going to commit” heart, a dreaded “we have to talk” heart, or even an “I’m complicated, but deep” kind of heart. Just hey, hearts, baby, I’m an extrovert, let’s groove on the dance floor and take some snaps!!!

I focus on this because right there in their identity they align themselves not with Software, but with Love and Play — a great gap to bridge. If the product sucked, it would be one thing. But it doesn’t. It makes bold choices and executes them well. They’re going for the whole tamale, not hiding behind industry-speak, and not afraid of a little heart and soul.

So, they have a lot to live up to. Moving beyond the logo, what does Skitch do that works and how can we learn from that?

It’s makes it easy to get started.
I haven’t taken the time to figure out all the features — in fact, I was too ADD to even watch the whole 3 minute video. But I didn’t need to. The critical 2 or 3 features are easy enough to get right away. Once someone commits, they’ll go deeper, but don’t make them wait, fiddle, or read a manual first. Make your learning curve the equivalent of 140 characters or less.

It does the things you’d want it to do.
This may sound simple, but it’s worth repeating. I wanted to take screenshots, write on them in fun fonts with arrows, then upload them to the web. Bingo. No matter how fun an imagined feature is, the trick is matching it to the intuitive use of your product. If people wouldn’t naturally want to do that thing, drop it. It doesn’t matter how slick it is.

It cuts out the middle steps.
In Skitch, you don’t have to select layers, like in Photoshop, to move items that are separate, such as text and arrows. You don’t have to explicitly save the picture on your desktop and then FTP it to the web — the app does it for you in one click. The designers have figured out your starting and ending points, then cut out all the excess steps in between. Spend time here, trimming the middle.

It makes it fun.
It understands that an application is not just about utility: you’re not just tediously trying to upload a picture to a website or share it with a friend — you’re having a moment in your life. Make that moment simple, and when you achieve that, make it fun.

It makes common actions unexpectedly pleasurable to use.
There are tons of patterns we use all the time when interacting with web and desktop applications. For instance, copy and paste. Copy and paste is great and I love doing it, but the folks at Skitch saved me a couple keystrokes by giving me a fun copy button on the image detail page. It wasn’t necessary per se, but it genuinely improved my user experience. So, don’t try to think about new things you could add: find out what the most integral interactions with your product are. Improve those.

Squeals of Delight
That’s what I did when I first used that copy button. That’s what I did when I clicked “webpost”, heard a whoosh, and saw that my screenshot was now on my very own Skitch web page. Go for the squeals: it means, this feels JUST RIGHT. If someone is squealing with delight (for Love or Software!) they are going to come back.

It’s not all paradise and apples of course.

There are confusing and frustrating interactions, just like in any product. These stand out more, ironically, because they raised the bar so high. So Skitchers, as you move forward, solve these problems for me :)

1. How do I get back to my home skitch page from a specific image page? You don’t really mean for me to click on the back button or delete the rest of the URL in the address bar after furrowing my brow looking for the obvious home link, do you?

2. Uploading. From my Skitch app window, I can’t click “webpost” right away because it first shows me “share”. Only after clicking on the “share” is “webpost” exposed. Since clicking “share” triggers a browser window populated with the Share link that steals focus, I have to tab back to Skitch to webpost. Annoying.

Overall, It was great to look at Skitch because it’s so well done. I think it’s worth taking a product apart to see why it works and how we can use those lessons in our own applications.

And finally, Full Disclosure: I have nothing to do with Skitch.

I just heart them.

ˆ Back to top

Rails Summit Latin America

October 16th, 2008 by comment desi

I am currently in Sao Paulo, Brazil at Rails Summit Latin America and the experience has been great thus far.

Ladies at the conference there is information at the end of this writeup about how to join. If you don’t feel like reading everything in this writeup that is fine but please do read about joining.

In contrast to many conferences I have been to recently I have been to just about every talk at this conference and I have thoroughly enjoyed them all. I say just about because there is a second track that is going on in another room but I haven’t been to those sessions.

The Organizers:
Fabio Akita and Gilberto Mautner Founder of locaweb have done a great job with the conference and I would like to give them a special thanks. The lineup, venue and everything has been great. Obrigado!

Theme:
I think most conferences, through the keynotes, some how seem to create a theme. The theme that I am picking up on at this conference is this: “Have No Fear” and “Just Do It”. No one actually said either of those two things but thats basically what I am taking away from most of the keynotes. They have all been especially encouraging for people to become involved. Contribute, create, and code. Give back to the community and get involved. Don’t be afraid .. put yourself out there and learn from the feedback you get.. learn from the experiences of creating.. do side projects.. basically be PASSIONATE.

The Talks:
All the talks I have seen have been excellent. I give them an excellent rating because they have all had the qualities I look for in a talk.
1. The content is good and interesting.
2. The delivery of that content is entertaining or at least engaging.

Chad Fowler – I really enjoyed Chad’s talk and as I sit here I am struggling to figure out a way to describe his talk and actually do it justice. He spoke about his background in music and how that has translated to his life as a developer. In addition, he spoke about being remarkable. He talked about many ways in which people are remarkable and many ways in which we ourselves can become remarkable people. He touched on many things and did so in such a way that I was able to stay engaged with him. There were pictures and video’s and graphs and fake numbers and.. anyway about the best I can say is that I personally really enjoyed his talk.

Dr. Nic Williams – Dr. Nic’s presentation is a little easier to sum up but at the same time I can’t really do it justice. Dr. Nic is one of those speakers that if you ever have a chance to see him speak you should definitely take the opportunity. He is hilarious and has a good message. His talk was all about how to contribute back.. how to get involved.. how to participate. Make the future you proud of the you now. Dr. Nic also talked about newgem

Chris Wanstrath – Chris’s keynote started off being about the future of Ruby and RoR but in the end he took it back to the past and where we have come from. He went through a great deal of history on how we got here which I personally enjoyed especially when he pointed out the first ENAIC programmers were all women, unfortunately he was speaking quite fast so I think a lot of his talk was lost in translation. I think the primary thing Chris was trying to get across is to not be afraid. If you have an idea.. make time to get to it you never know where thats going to go. In the very least you gain experience and you gain knowledge. Chris has had many projects in the past but his current claim to fame is all about github.

Jay Fields – Jay’s talk was about the immaturity of testing as a whole. While I agree with some of the things he said I also disagree with some of the things he said. I have had the luxury of getting to pair with Jay on projects before and its always interesting for me to see him speak because I have first hand experience with a lot of things he talks about. He described the problem of immaturity in testing as a whole first with the fact that we can’t even agree on common terminology. He then proceeded to talk about various tools and the pros and cons of each. He covered Selenium, Test:Unit, Rspec, Syntasis, and Expectations. The last two being the most immature of them all and bleeding edge. i.e. use at your own risk. He also answered a few questions about how to make your test suite fun faster and his response was basically that if you are willing to deal with the pain that goes along with it there are tools you can look into using such as null_db, unit_record, and ARBS. You can read about them on the null_db page on Agile Web Development site. That page links out to the other plugins. Jay also pointed out that all the things he was talking about are from his point of view. In other words its the context in which he works that causes him to have some of the testing beliefs he has.

David Chemlisky – David’s first talk was about doing TDD and in my opinion he did an excellent job of demonstrating TDD. I have seen him give a talk similar in the past and of all the people I have heard try to describe TDD, David is one of the most skilled at it. He gave the talk from the point of view of a teacher which in my opinion is really the only way you can truly explain TDD. He went through the process step by step with us all to show us the way. :)

His second talk was more about Acceptance testing and story runner and the newest version of story runner which is being called cucumber. He demonstrated how it worked and made sure to give context around all the terminology such as user stories etc. Hopefully there will be some way of seeing this talk again maybe through a screen cast or something of that nature. I’ll be sure to ask him if he would be willing to do that. Or maybe there is one with cucumber? Not sure haven’t had a chance to look yet.
Couple of links to stuff he talked about.
Cucumber
webrat on github and a blog post on it here

On that last note I am actually interested to know if these talks are being recorded and if they will be available somewhere? Anyone know the answer to that?

Obie Fernandez – I haven’t actually seen Obie give his talk yet but I have seen the talk (insider information) so I am going to go ahead and give a recap.. I asked him to plug DevChix and wanted to have this write up already done before he did so.. ;-) So Obie’s talk will be about the “Hashrocket Way”. He is basically giving up our secrets.. Like Dr. Nic said no secrets! His main focus will be around how we work, the fact that we follow Agile Tenants and that we value fun, collaboration, and effectiveness. We achieve those things through certain practices such as pair programming, TDD, Story Carding, launch parties etc. Again you should check out his blog.

Ninh Bui and Hongli Lai a.k.a The Phusion Guys – I woke up late so I didn’t catch all of the talk from the Phusion guys but the part that I did catch was hilariously funny and explained things like caching and database sharding. Additionally, they gave a demo of yuumis_comments.. and here is also a link to their blog

I call out all of these guys because they are some of the best speakers I have ever seen and I actually saw them speak at this particular event.

Phillippe Hanrigou – Phillippe is going to be giving a talk on how to effectively do acceptance testing which I am looking forward to but I won’t be able to cover that here because I haven’t seen it and since I don’t have insider info on that one I’ll just have to wait like everyone else. I do know that he will be talking about one tool I hadn’t heard of before called Deep Test. You should check Phillippe’s blog as well

Luis Lavena – Luis will also be giving a talk about surviving with RoR and Ruby as a windows user.. again I think the talk is going to be awesome but its in the future so I can’t really talk about that yet. You should check out his blog!

The Venue:
The venue is quite nice. The main auditorium is very well arranged and has plenty of room despite the fact that there are a lot of people here. There is a very large screen making it easy for everyone to see the slides as well as the speakers. The lighting on the actual speakers is a little weird but other than that the actual conference room is great. The audio is fantastic and the actual hang out area is quite nice as well (other than the lack of air conditioning but thats just me being a little whiny its not really that hot). One other really important point that I want to bring up is the translators. You can get a headset at the checkin area that will translate the talks from English to Spanish and Portuguese and from what I understand the translators have been doing a kick ass job so a special thanks to all those ladies in the booths translating for us.

The Community:
I was very encouraged by the number of people at the conference, the number of people using github (vast majority) and the number of people doing Ruby and RoR development on a day to day basis. It is always an exciting moment for me when I realize it is gaining in support because how much I love the language. In addition, everyone has been extremely helpful and friendly. We meet Tim Case the first day and he was more than willing to take us under his wing and show us around.

One thing that was both encouraging and discouraging is the number of women at the conference. There were women, thats the good news, the bad news is that I think from a ratio point of view the number of women at the conference is on par with what I have experienced at Ruby and RoR conferences in the US. That is to say its pretty small. Usually at conferences since there are so few women I can manage to talk to most of them and but here I have been some what intimidated by the language barrier. One other thing to point out is that there were no women speakers but hey that isn’t really that uncommon. I am hoping that when Obie does his talk and plugs DevChix for us that many of those women who were at the conference that I didn’t get to meet will come to the site and join.

Ladies Please Read
For those women who do happen to come to the site from Brazil and other countries. I would like to say that we have members world wide who can speak a number of different languages so please don’t let that discourage you from joining and participating. We would LOVE to have you all as part of the group. Also encourage other female developers you know.

If you are a women, a developer, interested in joining and/or contributing to DevChix, please contact Desi McAdam at info(-at-)devchix.com with your:

1. Name
2. Email
3. Do you know any one from DevChix?
4. A short 2 sentence bio describing your development background/experience (or what you hope to learn) and a link to your blog if you happen to have one.

Obrigado! :)

ˆ Back to top

Book Review, "Pro Active Record"

March 12th, 2008 by comment Nola

Published by Apress
By Kevin Marshall, Chad Pytel, Jon Yurek
Book Info
Sample Chapter: Ch. 01 – Introducing Active Record
Table of Contents

Years ago when I was in PHP Land (now I travel quite a bit more! haha), I strugged for months with how to write a good ORM . It was tough, because I wanted to abstract the “boring logic” of retrieving records from a database without writing SQL but still remain flexible enough. I never really came up with a good model. I used the DAO from “extreme php” library which I think was a knock off from java. It was ok, but I still didn’t feel like I had “arrived”.

When I discovered Ruby on Rails, I found ActiveRecord. Ahh HA! Finally, this is what I was looking for. At first I thought it was part of Rails, but its not. Its a standalone library and you can use it with straight up ruby scripts.

I got a review copy of “Pro Active Record” some time ago and read it some when I got it, then some later, and now I am going to officially write up a review!

If you do anything with Active Record, get this book. The things that are briefly mentioned in most Rails books are described in detail in this book.

Chapter 1 – Introducing Active Record

Most of the time, the first chapters of a book are boring to me. I don’t need another “History of the Internet” or how “HTML was developed” … blah blah. But this one, the story is only 1 page. And it actually has some introductory scripts on using Active Record, so you can see right away how it works. It also explains the benefits of MVC and why ORMs are good. Some people still don’t get it!

Chapter 2 – Active Record and SQL

This chapter helps you translate the “sql in your head” to how to write it with Active Record. I’ve used Active Record so much that now I have forgotten most of my SQL, which is kind of embarrassing. :) I now find writing sql tedious and boring! I would have actually called this chapter “Demystifying Active Record” since it explains why all the dynamic finders work. You’ll also find transactions and locking explained here.

Chapter 3 – Setting up Your Database

Migrations! The Awesome Thing that can turn into a nightmare for large rails projects with multiple developers…. definitely have to decide on some best practices with your team on this one. The chapter has only one thing to say about this — assume any checked in migration has already been run by your team and the migration should not be edited and checked back in! You’ll have to make another migration file with your changes.

[tip]
Nola's Note: When you make a migration, test it both UP and DOWN!! Here's what I do --
write a migratiion
rake db:migrate (go up to the version with new code)
rake db:migrate VERSION=n-1, (go to version before the latest)
rake db:migrate (back to lastest)
rake db:migrate VERSION=0 (back to blank db)
rake db:migrate (back to latest)
[/tip]

Just to be sure its all good — even on a new database!

Chapter 4 – Core Features of Active Record

Now is the fun stuff – Callbacks. This is magic. This makes Active Record so flexible, and is one thing I could never figure out how to do with my PHP ORMs. I use call backs to set defaults for fields. If its just a straight default, then I set it in the database but if I need to make a decision, (if this field then this field..) then I can use it in a callback.

Associations – at first this is very confusing! I don’t know how many times I got “has_many” and “belongs_to” mixed around in the beginning.

Validations – Awesome. I had to do some ruby code without a database and I really really really missed the validations. It took me like 5x longer than it should! Understanding all of these validation methods will make your life so much more enjoyable. I really really hate doing boring, repetitive stuff…it seems so wasteful to me.

Chapter 5 – Bonus Features

Everybody likes a bonus and this isn’t even the last chapter of the book.

Java people will like the Active Record Observers — seems a little AOP to me (aspect orienteted programming) and something I probably have neglected to use to their fullest extent.

Acting up — Learn how to “save time” with the “acts_as” magic: List, Tree, Nested Sets. If your data needs these structures, you got it made. I can imaging how much longer it would take to write this stuff in perl or php.

Composed of – I haven’t used this, but this looks like a good way to make sensible objects out of database tables. There is quite a bit of explanation and examples of this, it will come in handy.

There are a few other in depth explanations of things, such as method_missing which is how alot of the magic happens. Rock on.

Chapter 6 – Active Record Testing and Debugging

Ahh yes, Testing. My favorite subject. My friends who know how much I love testing say I am sick. I must have an inner need to PROVE I am right or something, haha.

The chapter goes into depth about using test_unit with Active Record, sadly no RSpec. But, it does go into all the error messages that Active Record throws so you can write good try/catch blocks and make very exact error messages (probably best logged for the admin rather then displayed to the user!)

Chapter 7 – Working with Legacy Schema

Here’s how you work with that old database that just won’t die… or that management won’t let you totally redo. Active Record follows some of the principles of Rails “convention over configuration” … relying on table and column naming conventions to figure out how to build your object….but still giving you a way out if you want your tables singular and your primary id field called “myawesomeid” instead of “id”

I’ve used some of these things on an older database and it was possible! Not too bad if thats what you have to work with.

[soapbox]
Some people find this annoying "oh gosh! my library can't make decisions for me! OMG! That sucks" .. to that I say, "Umm ok. But if you follow these conventions then I can come into your project and know exactly what is going on" ... like with web standards, we all harp on how IE and FF do things differently, yet people want to bellyache about Active Record preferring to have plural names and id field called "id". Right.

Follow the dang convention and find something worth complaining about to complain about. :)
[/soapbox]


Chapter 8 – Active Record and The Real World

This chapter goes into depth about the library and encourages you to go read the Active Record code. Always a good idea to know what it is you are using :) I’ve actually learned ruby better by reading source code. The chapter walks you through basic structure of the files. Very cool.

[soapbox]
I used to work at a place that didn't like any "outside code" because they were afraid "OMG ... it will send our passwords to Russia!" ... ok, well I am not an idiot. I read over any code that I use that I didn't write. I look at the tests to see if I am using it right. I even RUN the tests so I can be sure its working as advertised.
[/soapbox]

Alternatives to Active Record – with EXAMPLES! If something about Active Record doesn’t set too well with you, take a look at the alternatives. Sometimes I look at the alternatives and decide that the first wasn’t so bad after all. You’ll find examples of DBI, Og, ActiveRelation.

Finally a section on Q and A finishes up this book. The Appendix has a complete reference of ActiveRecord methods to make this book a well rounded reference, tips, documentation and very handy to have at your desk!

ˆ Back to top

Book Review: Pro Drupal Development

August 12th, 2007 by comment Nola

Book Site | Sample Chapter: The Theme System | Table of Contents

Many of you are aware of my current total infatuation with Ruby, and that I’ve used PHP for about 6 years and at one point decided I hated PHP…until, I needed it for a quick one-off page and then realized that PHP had its place. Then again, I was totally frustrated with Ruby when making my moms bakery site and then turned to Drupal and Gallery (another fine PHP project), which saved my bacon and I got a website and photo gallery up in a weekend. So, PHP and I have had our moments but I’m not abandoning it!

Drupal powers some big sites, its not just for joe smoe’s blog. This is an interesting page about Is Drupal Right For You? and if you are wondering if its something that would even work for you.

I was excited to get my hands on a review copy of Pro Drupal Development. Its no secret that coders hate documentation and Drupal has one of the most complete online documentation I’ve seen for an Open Source project, but its almost too hard to find what you need amongst so much. The Pro Drupal Book is a godsend for the drupal programmer, new and experienced alike. I wish it was written a year ago!

The book starts off with a quick overview of how Drupal is structured and defines terms such as hooks, node and blocks in just 10 pages. Chapter 2 is a A step-by-step tutorial with making a module. That is a great idea to start off quickly writing code. It get the reader involved and hands on. I really tire of books that have to start off with the history of the internet, html and how things have evolved. Get to the code dangit!! Kudos to the Authors for that! Chapter 3 gets into module specific settings, like how to get your module to show up on the admin page and storing user settings that your module needs.

After you’ve had some experience with the code then the book goes into details on the specific parts of Drupal:

  • Menu System
  • Databases
  • Users
  • Nodes
  • Themes
  • Blocks
  • Form API
  • Filter System
  • Searching and Indexing
  • Files
  • Taxonomy
  • Caching
  • Sessions
  • JQuery
  • Localization
  • Using XML-RPC

Drupal is a pretty amazing framework, when I read the code I say “why didn’t I think of that?” … the module and hook system is genius.

Then some more general topics:

  • Writing Secure code
  • Development Best Practices
  • Optimizing Drupal
  • Installation Profiles

One of the chapters I skipped ahead to read was The Form API. In my years of PHP I’ve often tried to come up with a framework for doing forms and I wanted to see how they did it. This chapter follows a tutorial style as well. The Form API allows you to define fields, their label, their value, description. Some frameworks take the template approach, where you hammer out your HTML. Some are more configuration based like Drupal making a multi-dim array with keys and values. I can see advantages to both. There is a hook function for validation which allows you to write your validation checks.

PHP gets a bad wrap for security, partly because its pretty easy to learn PHP and newbies don’t always realize what they are doing. There is a chapter devoted to security and includes even some things I didn’t know about — encoding mail headers. The Form API is very secure,  one thing it does is check values that come from dropdowns were actually in the options and it wasn’t something that the hacker made up.

Developer Best Practices are great for the new developer, it talks about using cvs, tags, branches. It talks about how to create and apply patches (hint – you can contribute back to drupal). That is awesome. Alot of open source projects are like “HELP us, submit patches!” and the new user is left with uhhhhhh..how?

Caching is another interesting chapter. You will learn  how caching works and how Drupal Core uses it. There is a Cache API that has methods for module creators to make their modules faster.

JQuery … I am not sure if I like it or not, but its part of Drupal 5! I skipped ahead to this chapter to see what its all about. There is a javascript hook built into Drupal making it easy to add, thats pretty cool.

One thing I found lacking in the book is anything about Testing. There are few pages on debugging and some modules to help with testing, but I would like to see more. At least some talk about selenium, which is great for a site made with any framework/cms.

Over all, Thanks APress for another great book!

ˆ Back to top

Let's All Evolve Past This: The Barriers Women Face in Tech Communities

June 9th, 2007 by comment gloriajw

Topics of this Article:

Introduction

This subject has been on the minds of many tech women for years. The issue is discussed regularly, almost cyclically at times, as we spin our collective wheels to try to find causes and solutions. I was reluctant to write about it, since I find the subject matter daunting, and the problem almost insurmountable at times. But three different sources approached me simultaneously, asking for this article. This article feels as if it is manifesting through me rather than from me, as a collective opinion and observation from the many tech women with whom I’ve worked and spoken. So many factors are in play when discussing this issue that I can only hope to address many of them without writing a tome.

My tendencies are to pick up on patterns, in human interaction, in data, in almost everything. I am a computer science/math major, and my brain loves to seek out the unobvious patterns in whatever I am observing. One of my favorite pastimes is to figure out broken elevator algorithms: what event causes the doors to close too quickly, how are the cars distributed amongst the people requesting the elevators, etc. One of the not-so-favorite puzzles my brain likes to do is to pick up on patterns of human behavior from both men and women which affect how tech women are treated both on and off the job. This article is all about the patterns I and other women have found in human interaction, office and online environments, which make them less conducive to tech women participation.

The less obvious

I won’t be addressing the more obvious problems affecting women in tech environments such as the pay scale gap between women and men, the blatantly inappropriate sexism and personal harassment that has taken place, and persists. My reasons are because I feel these issues have been properly and effectively addressed by other women in tech (they’re not resolved by any means, but at least public awareness is rising). With this article, I am attempting to address the less obvious or unobvious reasons why some tech environments are intolerable for many women.

The material for this article came about through my participation in both women-only and mixed gender groups of many kinds. When I wonder why tech groups aren’t tolerable for many women, I look at the inverse of the problem: What makes women-only tech groups more tolerable for women? My observations follow.

Why do women-only tech groups exist?

Over the years I had participated in many different types of women-only groups. Women-only drumming groups, women-only political groups, women-only tech groups, have all provided what women consider to be a “safe haven” to freely learn these arts, share ideas, expose each other to paid “gigs”, and help each other accomplish tasks. Women in these groups usually had nothing else in common except for the fact that they (1) were female, and (2) shared an interest and experience in drumming/politics/tech. Their professions, ages, skill levels, hobbies, sexual orientations, life experiences, marital status, children/grandchildren/no children, everything else about these women varied vastly.

My brain began to try and pick up on patterns which would explain why all of these different types of women feel as if they need a women-only group, and what such a group can provide that a mixed gender group cannot. Here are my observations.

Community plays an important and prevalent role in women-only/women-friendly groups.

No matter the group or the reason for gathering, _all_ of the women-only, and most of the successful women-friendly groups to which I have belonged had a strong sense of community. They make a tremendous effort to communicate well, to be fair with each other, and to provide support related to the groups goals, sometimes even extending outside of the groups goals.

This mindset is so common that women come to expect it when joining these groups, and foster it once they have joined. The implied message is that a strong, focused, collective effort will be spent to run things fairly and treat all members equally, and collective discussion happens when this is not accomplished. This is the lure to women-only groups.

Communication style is directly affected by this sense of community

I have never seen a woman harshly criticize another woman in these groups. Never have I seen or heard anything like “You suck”, “You’re wrong, idiot” when women in these groups communicate. Differences are usually discussed in a civilized manner. There is the occasional strong disagreement or ousting of a member now and again, but it happens after a discussion involving the entire group, and an effort to work out their differences. I am sure harsh criticism happens somewhere in some women’s groups. But I am also sure that it’s not tolerated for very long by other female members.

This style of communication is directly at odds with much of the harsh criticism and disdain found in predominantly male public comments, especially in most public online tech comment spaces, unfortunately.

Destructive criticism is the best way to keep a site predominantly male. It implies that there is no concern about whether a person can learn from a response or not, or whether they would find offense. It is an outward display of ego, a territorial “pissing rite” in which most women do not and will not participate.

That being said, there are many men who flock to women-only groups for the same reasons as women. They do not want to be subjected to the predominantly male style of communication where there is no sense of community, or even just simple accountability. They grow tired of the “pissing rite”, the absurd declarations of false boundaries, the outward display of insecurity through harsh criticism, implicit claims of “my way, my expertise, my right, never yours”, and poor display of ego. This mode of communication is an unproductive waste of time, and many men realize this as well. “I feel at home here because I really don’t want to deal with that male ego bullshit”, one male member of our political group stated to me.

Men who seek out women’s groups are usually welcome, or a splinter group is formed to accommodate these men, once it is determined that they do not seek membership for the wrong reasons. Some of the wrong reasons are:

(1) “I will be the only male member, and will therefore have my choice of ‘chicks’”. Nope. It’s not happening.
(2) “I will be the only male member, and I’ll guide/help/protect these lost/vulnerable/endangered women”. This is not only unnecessary, but laughable. Women find the implications of these assumptions both offensive and so primitive that it is hysterically funny.
(3) “I will infiltrate because I hate women, and want to try to dissolve the group in some way” This is very rare, but happens. The good news is that the motives of both men and women who attempt this become very obvious very quickly.

Women-only/women-friendly tech groups and gatherings offer a level of awareness of and accountability for behavior not found in most mixed gender tech groups/gatherings.

Awareness of and accountability for behavior in women’s groups means a lot more than just safety from sexual harassment, or discrimination. It means that if one is treated unfairly or harshly in any manner that a person finds offensive, the entire community will hear your claim. They will give you advice, opinions, and will collectively decide if action should be taken.

There has recently been a call for all public message board admins to get tougher about removing blatantly discriminatory, harassing, or sexually objectifying comments. This is a very necessary, damned good start. But to genuinely make an online tech community women-friendly, it needs even tighter moderation against harsh/demeaning criticism, elitist commentary, and exclusionist statements, the three most prevalent and women-unfriendly types of communication found in almost all moderated online tech message boards. There is no better way to give women a message that their comments are not welcome than implying that: (1) this is forbidden territory, women have no expertise here (2) your comments are stupid, wrong, or ridiculous, (3) we’re so much smarter than you.
Discussion, constructive criticism, even heated debate happens in women-only groups, but these methods of communication are avoided.

Both online and off, I have seen men who communicate this way with everyone, and men who only choose to communicate this way with women. I have also seen this behavior tolerated or ignored for the most part. Here are my observations on why this happens.

Men are generally very good at ignoring bad behavior.

This is both a blessing and a curse. In my most recent office environment, we had situations where a male colleague’s behavior was abrasive in one of these three ways mentioned. “That sucks, doesn’t it?” I asked another male colleague. “Yeah, but I just ignore it. That’s just the way he is. He is always like that” He responded. This is what I’ve seen as the general male way of coping with this poor communication style.

It’s a blessing that many men can ignore it, in the sense that most men do not get caught up in deep analysis of why this person said a specific thing, and what this person could have really meant, etc. When almost everything is taken at face value, and not overanalyzed, the ability to ignore communication issues makes it is easier to resolve the simple issues, and move on. I have seen some women in office environments do the over analysis, and take offense when there never was one given. I don’t see men do this very often, and it makes communication quicker and easier.

Ignoring communication issues is also a curse because one obnoxious person is allowed complete freedom to make excessive noise, be rude and disruptive, or explicitly offensive. Most men, online or in the office, will ignore it. Most women will notice it but not say or do anything about it, for a variety of reasons which are tangential to this article. The offender often thrives on the fact that no one told them to stop, so they continue. Sometimes the offender is not socially adept enough to pick up on the fact that ignoring implies intolerance at some level. They somehow missed the message most three year olds learn: I’m ignoring you because I don’t like your behavior, so they continue the intolerable behavior.

This is so prevalent in online tech communities that it is the primary reason why many women do not participate. The poor communication and behavior of even one boorish, ego-driven, elitist, socially inept geek is just simply intolerable for most women. Women generally tend to assume that everyone will be conscious of and annoyed by this behavior. Men tend to assume that everyone will ignore it. This causes problems in offices as well as in online communities, where women will complain about such behavior, and men will issue responses such as “toughen-up”, or “what’s the big deal?” because this is how they cope with the problem. A female-friendly group addresses and tries to resolve these issues, while the average group ignores it until/unless the person does something heinous.

The sense of community fosters a protective behavior within that community.

If you do something awful to one woman in a women-only community, all will hear and know about it, and you are ousted. Most of the time this is first discussed and voted on by many group members. Many times the women’s group will even make an effort to explain the offense to the oblivious offender. But if the offender is still oblivious and/or offending, the offender is out. This is done to protect the interests and goals of the group. Many male dominated online groups don’t run this way. Most if not all women’s groups run this way, whether online or off. This relates to the awareness and accountability mentioned before. It’s an essential element of all women-only groups, and seems necessary for women-friendly groups to draw women.

Women’s groups generally have a few vocal, and many silent, members
The vocal few express their opinions, and either gain support or do not gain support. The ones who gain support usually implicitly become the spokespeople for the silent many.
The silent many usually let the vocal few, with whom they agree, do the job of ousting, protecting the sense of community, and publicly representing the silent many. The silent many support the vocal few. The community in turn supports and protects the rights and privileges of the silent many.

Why this happens is again a dynamic which is tangential to this article. But it seems that many women in group participation give either their silent support or rejection, speaking up only occasionally. Because of this behavior, if a communication problem arises in any type of group, whether women-only or not, and there is not a vocal few who will attempt to resolve it, the silent many will often silently leave. The silent many often don’t want to complain, for fear of having to deal with the additional frustration of the unaware/unconcerned “toughen-up”, or “what problem?” type of responses. For the silent many, it’s easier and less frustrating to just leave. I think it is important for groups that want to advertise themselves as being women-friendly, to be aware of this pattern.

One of the challenges of any women-only/women-friendly group is encouraging the silent many to speak up. Many women deal with demeaning and discriminatory behavior so often in their lives that they are too emotionally exhausted to deal with even the possibility of an online onslaught of anonymous discriminatory and demeaning comments. Many women spend time observing online groups before deciding if they will participate, for this very reason. They want to ensure that they will not feel verbally attacked once speaking up, and that their issues, comments and contributions will be heard and handled fairly.

Women generally do not arm themselves for battle during tech discussions

Women generally do not work things out through verbal battle. By the time they
reach that point of wanting to argue, they are already so offended that they are in pure self-defense mode. Women treat the discussion of tech issues like the discussion of many other issues. It’s not competitive, and they wish to bi-directionally share information.

Many tech men envision a technical debate as a battle, and celebrate the supposed victory, exhibiting classic “Alpha Male” behavior. I have personally seen it so many times in my profession that I brace myself for it when discussing tech issues with new groups of men. So many of them arm themselves with weapons of aggression, demeaning comments, and behavior which encourage more of a filibuster than a healthy debate. The supposed tech discussion becomes a test of verbal and emotional endurance, where whomever can argue the hardest and last the longest wins.

They can shake hands afterwards and congratulate each other over a “good fight” after a technical debate. “I like the challenge of a good argument, which is why I do that” one male colleague explained to me. “I like a good technical debate too, but I don’t want to feel verbally or emotionally abused afterward. Women don’t fight for fun, they fight for personal issues.” I explained to my male colleague.

Unfortunately, the anonymity offered by many public wikis and message boards encourages the worst behavior in people. Even moderated tech chat areas and comment boards are rife with elitist, demeaning comments encouraging “the fight”. Some of it is due to oblivion, lack of knowledge that this is offensive to tech women. Some of it, unfortunately, is very intentional.

Apparently there are males online, in tech communities, who still believe that, like the cigar rooms of the Victorian Era, tech rooms should be male-only. Back then, the predominant purpose of smoking cigars in a common room was to have male-only space, and similarly today, the purpose of the demeaning and fight-provoking attempts is to maintain the male-only presence of some online tech spaces. I know for a fact this happens with intent in some online chat rooms and message boards. It is not simply an act of oblivion, but a concentrated, misogynistic effort between like-minded men to keep women out.

When I discuss this with people and we ask each other how this can be prevented, I feel overwhelmed. How do we stop any/all of the human behavior which prevents us from evolving further? I have no answer to this, but I am certain that if less of this behavior is tolerated online, we at least squeeze people who discriminate into their own, personal hidden online spaces. There is no reason why we need to be subjected to every single person’s beliefs or comments in the name of the First Amendment. We all have a right to remove from our lives anything and everything which holds us back in some way, even that which is subtly harmful or offensive. Web admins have a right to remove useless, demeaning, even subtly harmful comments in the best interest of an online community. The operative word here is “community”, and the appropriate questions is: Does your public comment space contribute to a community, or is it just an open toilet that everyone can vandalize and pollute?

Did you know?

When it was illegal for women to publish writing during various times in history throughout various countries, women published their work under male pseudonyms. Today, many tech women still use male pseudonyms when posting to lists or publishing tech articles. The reasons are to have their work read without bias, and to avoid misogynistic “hyper-scrutiny” of their work. I have experimented with this myself using a male pseudonym to post articles, and being told that the articles are informative, useful, great. Six months later I republish the exact same article, using a different title and a female pseudonym, and suddenly the article is horrible, technically incorrect, useless. It’s a fascinating study. I would love to see some prominent male techs publish under female pseudonyms, and watch the responses.

Women find it awkward to brag about their writing accomplishments published under male pseudonyms. For this reason, most of this work never gets credited to the correct person, and is never acknowledged on resumes or during job interviews. “How do I explain to a male ‘potential boss’ why I have chosen to use a male pseudonym, without bringing up the whole discrimination issue?” is what one female tech friend asked me. I had no answer for her. I have also let my work published under male pseudonyms fall between the cracks, into oblivion, not knowing what else to do.

To make an online community more women-friendly, try these suggestions:

(1) Monitor the public comments. Treat the public comments interface much like the
front door to your home. You don’t simply leave it open for any idiot to waltz in.
You can be selective regarding who comes in, and what they do once they’re in.

Useless comments get deleted as quickly as they appear. Any non-technical,
offensive, destructive, or off-topic comment is removed. This gives a clear
message about will and will not be tolerated. As useful comments accumulate,
useless ones are much less likely to appear.

(2) The technically correct but aggressive/demeaning/overly harsh comment gets returned
to the sender, asking the person to re-word using constructive criticism.
Sounds like overkill, but it’s not. The “You’re wrong, here’s the right answer”
type of response constitutes picking a battle that most women won’t fight, or won’t even bother dealing with.

(3) Treat your online space like a community. The web admin should act is if they’re on the board of chosen freeholders, voting on issues which affect themselves and the entire community. Don’t just throw up the comment space and leave it abandoned for vandals and other jerks. Maintain it according to the rules by which you want everyone to abide, and stick by your decisions. Have accountability for comments. Create a space where open discussion happens as if it were in an educational surrounding, not a seedy bar.

(4) Explicitly state that your site is women-friendly. Doing this will encourage the silent many to speak up. Kick out the jerks who don’t want your online space to take this direction.

For the men who care: Tips for communicating with women in Tech environments, online and Face-to-Face

(1) Tech women usually express great enthusiasm about their work. They do what they love, and they love what they do. When a woman gets enthusiastic about her work and shares that enthusiasm with you, it has absolutely nothing to do with you, or sex. I cannot tell you how often I have seen this. Some men mix up their incoming signals, and a women’s enthusiasm at work somehow translates to someone flirting with them at a bar. I have no idea how this happens, but it’s profoundly sad to see it happen again and again. If you’re lacking something in your life, please do not look to your female tech colleague to fill that niche. Do not even presume her mind is there even if yours is not, because hers is not, and your signal indicator needs serious recalibration.

(2) Leave your libido at the door. Please. Women tech colleagues want to be appreciated for their brains, their technical expertise, their contributions and accomplishments. Tech women do not give a flying shit about what their male colleagues think of their attire, their make-up or their body parts. Believe me when I say this is true. Women may give you a polite response, but on the inside they are offended, seething, and considering whether or not to go to their attorney. They will ask other women in the office or field if they too suffer from this problem, building an alliance against men in their company who do this. And soon you will have a legal problem. Leave it at the door, pick it up on your way out. No one else wants it.

(3) Some tech women dress up for work. It is NEVER for you. Many tech women wear clothing which makes them feel good. For some, comfort is paramount, if for example the tech female is crawling through the ceiling, moving dusty panels and running CAT5 cable. For other tech women who would not get their clothes ruined at work, they like to dress up. “It makes me feel confident. I look at myself in the mirror and I feel good.” my female colleague told me. For tech women at work, feeling “good” does not mean “sexy”, and it is not for you at all. It is entirely about self-confidence, self-encouragement, and giving one’s self the extra strength to prove they know their stuff in a technical environment. Note the emphasis on “self”: it is entirely for her, by her, and your reaction is entirely irrelevant.

I have heard males say horrible things in professional environments like “Well, you wore that dress, you do look great in it, that must be the reaction you wanted. Isn’t that why you wear that dress?” The answer is no, fool, get over yourself.

(4) Tech women are generally open-minded about what is commonly called “guy humor” and “guy socialization”. Guaranteed, many of them, myself included, have male friends with which they hang out on a regular basis, so this is far from a foreign concept to tech women. Chances are, the tech women of your group would enjoy your jokes and would like to be invited out for beers, as long as points (1) through (3) above are met. I personally enjoy and share many of my own raunchy or lewd jokes if I feel safe around the people with whom I’m joking. I enjoy hanging out afterwards over a beer or two, or going out late with “the guys” to a bar to welcome the “new guy”. These things could be fun for everyone if (1) through (3) are in order.

(5) To the men who do not do any of this: Thank you so much. We notice, and greatly appreciate this. I have been fortunate to work with some excellent men in tech, and I wanted to thank you and the many others for not being this way.

(6) No, women are not perfect. This article doesn’t imply or suggest that women are close to prefect and men are far from it. I know there are female stereotypes not mentioned in this article, mostly because I personally don’t find them in tech environments. Your experience may vary. All of these points can be applied to both genders. But the fact that I was asked by several different sources to write this article proves that there is a recognized gender divide in many tech spaces. All of what I have posted is what I and others have observed and experienced. None of it is fiction.

(7) Is someone making you feel uncomfortable? Speak up! If someone at work makes you feel uncomfortable, tell them so. If you feel discomfort coming from another person, and you think you’ve caused it inadvertently, say so. Make it clear and shove it out of the way as quickly as you can, so work can continue. This applies from/to men and women.

(8) But isn’t creating a women-only group, and using terms like ‘male behavior’ reverse sexism? Doesn’t this defeat the very goal you wish to achieve? My response is no, not if these tools/verbiage are used to try to ultimately achieve equality. If it’s used for mudslinging, or through some act of elitist exclusion, yes, it is reverse sexism.

Credits: Many thank yous to Carla Schroder for sharing her infinite wisdom and encouragement. A huge thank you to all of the women at LinuxChix.org for your tireless support of the cause over the years. Thank you to DevChix.com for giving my wayward articles a very worthy home. Thank you to the many readers who have left constructive criticism and comments.

ˆ Back to top

Book Review: Beginning Ruby On Rails E-Commerce

May 12th, 2007 by comment Nola

Beginning Ruby On Rails E-Commerce
From Novice to Professional
by Christian Hellsten and Jarkko Laine
published by: Apress

Book Site | Sample Chapter | Table of Contents

I got this book to review and set it on the shelf for a few months… by the time I got to it Rails was up til version 1.2 and this seems to be written for version 1.1.2 – DOH! I tried a few examples and wasn’t compiling. After a little investigation there are only a few differences that would hinder this book from working with Rails 1.2. Namely, the assert_select has replaced assert_tag. That being said, this book is still great and applicable to Rails today. If you think about it, with as fast as Rails as grown it is impossible to keep 100% up to date!

This book is totally fantastic for beginners – because it actually shows Test Driven Development. What you say? Most books say something like that “to keep code size down, tests and error checking have been left for an exercise to the reader” … Riiiiiiiiiiight. How are you going to teach people coding that way? Tests should just be an automatic task of a programmer. Write some test… write some code. I honestly can’t imagine anymore how you could code anyways without them!

Not only does this book cover testing (including acceptance testing with selenium in later chapters – whoo hoo!) it starts out with not using scaffolding. I think, and this happened to me, at first I used scaffolding for everything and didn’t really understand the process. The book first goes through the “scaffold process” by hand, writing each method and view – after writing the test. Very cool. Then it tells you how to use scaffolding for the next model in the sample application. Awesome.

It talks about common concepts for really any site – tagging, adding forum, adding a form to upload images, browsing a list of products, multiple language support. Even if you are not selling anything on your site, you will still find this book extremely helpful.

Impress your friends! Learn how to write a DSL for testing. This is cool stuff, DSLs fascinate me to no end. Any and all mentions of it I study intently. Rails is in a way, a DSL for web applications!

Being true to the title “e-commerce” it actually talks about how to do payments over the web. Most books who talk about shopping carts skip that important step!

When you are ready to make your millions on the web there is quite an extensive chapter on deploying your site. It talks about LightTPD, capastrano, caching, and security! Its really nice to have all this in a book, instead of constantly looking online for documentation

My only complaint is – it doesn’t specifically mention what version of rails it used, I assume from the output of script/about that is 1.1.2 … and they should of talked about how to check out a particular version of Rails, just in case you wanted to use the exact version that is used in the book. Which may not be a bad idea for new users.

ˆ Back to top

Windows, Subversion and Tortoise

March 16th, 2007 by comment Carmelyne Thompson

Download Subversion (win binaries)

Download Tortoise

Fig. 1 Pretty Overlays

Sample 1

Fig. 2 Integration with Explorer

Sample3

Additional Sources:
Using Subversion on Windows
Subversion on Windows quick start

ˆ Back to top

Book Review: Pro PHP Security

February 25th, 2007 by comment Nola

ProPHP Security

Published by: Apress

Authors: Chris Snyder and Michael Southwell

Book Site | Sample Chapter: Preventing SQL Injection | Table of Contents

At first, I thought this book was all about cleaning your input variables and filtering your output, XSS attacks, SQL injections but I was most presently surprised to find that it was that and so much more! In fact, I would have called this “ProPHP Security and Administration” instead! It is absolutely fantastic. It really is about security in all of the facets of web development – from server, to code, to database to the system users.

The book is divided into 4 parts:

  • Part 1: The Importance of Security
  • Part 2: Maintaining a Secure Environment
  • Part 3: Practicing Secure PHP Programming
  • Part 4: Practicing Secure Operations

Here are some brief overviews of the sections and the tidbits I found interesting:

Part 1:

The first part is the shortest and gives a general overview the what and why of security.

Part 2:

The second is much more hearty and goes into detail about Shared hosts and why they are secure and how to make the more so. It even dips into alternatives for the traditional shared hosts and goes into Virtual Machines. This is valuable to not only to administrators but to PHP Developers. After reading this, I understand the “why” behind many of the things about shared hosting that I found frustrating.

One of the most important things I found in this chapter is how to maintain separate development and production environments. When I was helping to set this up at one of my past jobs it was a topic that I couldn’t find much information about. It also makes mention of version control, using wikis, bug tracking, sandbox and testing! Oh and here’s a concept…. pretend your live system failed — how well does your backup plan work?

How many times have I thought, I should make a cron job to back up my database to my home server every day/week? Have I ever done this? No! But now I have no excuse! Backing up a database and storing remotely is one of the sections in this chapter and code included! Fantastic.

There are chapters about Encryption theory and practice which I read several times to understand. It was interesting but it wasn’t something I have to do right now in my life, but I will return to this book to refresh my memory when I do.

Securing Network connections SSL and SSH, these proved helpful as I have become the “Reluctant System Admin” for one of my projects — partly because if they were to hire a part time person I’d rather they get a CSS person and I’d rather do the sys admin!

The Controlling Access section goes into details about using certificates with php, single sign-on, basic and digest http authentication … whoa this is some deep stuff! But good, when I was looking into this for a project a few years ago I couldn’t find anything helpful. It continues with then permissions and restrictions, a lot about Unix permissions and keeping things running where they should, securing databases and PHP Safe mode!

Part 3

Finally — the stuff that I thought the book would be about – validating user input, filtering output, preventing cross site scripting attempts, remote execution.. so much more to security than I thought! It talks about securing temp files, I always assumed the OS handled this and I didn’t need to worry.

Part 4

Ahh — Practicing Secure Operations… all you ever wanted to know about making sure your users are humans, verifying your users, setting roles for users, logging your users actions, preventing data loss, executing system commands safely, working with webservices and finally Peer Reviews! Sometimes it’s that extra pair of eyes that can see things you miss.

Something I find interesting – in the section about preventing data loss, it talks about setting a flag on records that are “deleted” and then making a db view of the “good” data and using that to select from. One of the things I like in Ruby On Rails is this “acts_as_paranoid” model option that does about the same thing. Neato.

Pro PHP Security is a most excellent read and so much deeper than my brief overview here. It will be a handy book on my shelf to keep me on my toes regarding security in all areas of web development, from the server to the code, to the users, to best practices of security you will find this is a helpful book too!

ˆ Back to top

CSS Debugging and Editing with Firebug

February 12th, 2007 by comment jen

Occasionally a new tool comes along that literally changes my life. Prototype, del.iciou.us, and most recently, Firebug. Using it, especially when evaluating CSS and javascript (especially when it’s all over!), has increased my productivity and saved me from many migraines. In this post, I plan to focus on some of the helpful features for debugging CSS. In a later post, I plan to cover how wonderful it is to debug and test javascript in firebug,

Especially on websites that have a lot of nested styles, finding where that extra padding is coming from can be a headache and waste a lot of time that could be spent being productive. With firebug, you can quickly see where each element is getting its styles and the full cascade of styles affecting it. From there, it is easy to alter the CSS and html live to figure out what needs to be done for the desired effect. This feature can be used for a world of uses. For example, say I wanted to override some of the CSS on my orkut.com profile. First, I open up my profile and open firebug:

The green check mark in the bottom right indicates that there are no errors (you can choose to display any or all of the following: javascript Errors, javascript warnings, CSS errors, or xml Errors) used on the page is valid. The dropdown list displays where styles are being defined.

Select “inspect” from the menu then hover to select the element to edit. On the right hand column, the styles are defined specifically for the element, but also what it inherits (font from panel table) and what is over-written (font from main table class). Dreamweaver 8 has a similar feature for showing the cascade of elements. As an added benefit, each of the rules listed has a hyperlink back to the file where it is defined. Also in this screen shot, notice that firebug displays the html hierarchy as a breadcrumb like chooser for the currently selected element. This breadcrumb is clickable and allows for quick access to the nearby html elements.

Here you can see how easy it is to work with or turn off styles. One great feature displayed in this screenshot is that when hovering over a defined color, a pop-up displays the color. The same is true for any images that are used in a style or in html.

And, viola! In only a few short minutes, I am able to find and define what style classes I want to override and see what the page will look like live as I made the adjustments:


ˆ Back to top