transcyberia.info - technology

implementing Plone subsites with p4a.subtyper

nospam@example.com (Guido Stevens) — Mon, 10 Aug 2009 15:55:00 +0200

One of the interesting things about the upcoming Plone 3.3 release is it's consistent implementation of INavigationRoot

In short, this means it's easy to create a design where the portal tabs (the "global sections") do not need to be toplevel folders in your site. I need this for a design I'm currently implementing, where the horizontal "main" navigation is actually the second-level navigation.

Now, instead of rewriting the complete global_sections viewlet PLUS the webcouturier.dropdownmenu integration... all I need to do is mark an intended "toplevel section" as such by applying the INavigationRoot marker interface.

There's a content type NavigationRootFolder that does just that. But it's not properly eggified.

It's easy to write your own custom contenttype that subclasses ATContentTypes.content.folder.ATFolder and apply the INavigationRoot marker interface to it. But still, you need to do all the plumbing.

Luckily, we've got p4a.subtyper. That's a nifty little component that's been designed precisely to apply marker interfaces on content objects, run-time. This allows us to be lazy, which is A Good Thing®.

What we're going to do, is set up a marker interface that allows us to turn vanilla "Folders" into "Sections" that behave as-if they're subsites.

Continue reading "implementing Plone subsites with p4a.subtyper"

fixing emacs css mode

nospam@example.com (Guido Stevens) — Wed, 29 Jul 2009 13:36:00 +0200

Indentation in emacs css mode was driving me crazy. Luckily I found this blog entry who quotes this blog entry who quotes yet another source that is offline now.

These settings didn't quite work though. CSS mode had to be loaded, before setting the cssm variables worked.

The resulting block in my .emacs:

;; fix css mode
(require 'css-mode)
(setq cssm-indent-level 2)
(setq cssm-newline-before-closing-bracket t)
(setq cssm-indent-function #'cssm-c-style-indenter)
(setq cssm-mirror-mode t)

This still gives an error on the first edit on a new css file. But works as intended in normal circumstances. Back to work now

interface design in the Apollo age

nospam@example.com (Guido Stevens) — Sat, 18 Jul 2009 21:16:00 +0200

To date 40 years ago, Apollo 11 was on the way to making history. In his fascinating study Digital Apollo - Human and Machine in Spaceflight, David Mandell traces the development of computing technology supporting the Apollo project.

The book opens a window on the birth of software engineering as a discipline. Some stuff is highly unfamiliar, like programming with "core ropes" .

sewing a core rope

The permanent memory, which stored the flight programs, consisted of a complex series of wires running in and out of magnetic cores that determined if a particular bit in a memory location was a one or a zero.

Other issues are shockingly recognizable after all those years.

Continue reading "interface design in the Apollo age"

reviewing osor.eu

nospam@example.com (Guido Stevens) — Tue, 30 Jun 2009 13:32:00 +0200

Last week, the nice folks at osor.eu invited me over to do a usability review of their website.

OSOR (Open Source Observatory and Repository) is a multi-year project by the European Commission to promote open source software use in public administrations.

We were able to have a very frank and constructive dialog about usability issues with the current website. The site is a Plone CMS frontend coupled with a Gforge software repository.

There's a couple of design inconsistencies in there that are deeply rooted in the project's mission concept, and fixing them runs into policy constraints. Meaning, it can't be fixed right now.

This confirms my experience, about the way that organizational fuzziness tends to show up as design inconsistencies. Which then translate into technology and usability problems further down the line.

Creating a truly open dialog that connects technology design with business strategy, results not only in better designs, but also improves organizational learning.

customizing navigation in Plone3

nospam@example.com (Guido Stevens) — Tue, 05 Aug 2008 13:17:00 +0200

Once upon a time customization of the Plone navigation portlet was easy. You just dropped a customized portlet_navigation.pt into a skins layer and presto.

In Plone3, customizing the navigation is still very easy. But it requires a bit more understanding of the component architecture.

Continue reading "customizing navigation in Plone3"

autonomo.us cloud computing

nospam@example.com (Guido Stevens) — Mon, 21 Jul 2008 11:50:00 +0200

A flurry of activity on free software blogs addresses the losses of freedom brought about by cloud computing.

The Free Software Foundation is concerned, that:

the movement of software off of personal computers has reconfigured power relationships between users and their software and complicated questions of ownership and control in ways that free software advocates do not yet know how to address.

Cloud computing presents a centralization of resources, hence a centralization of power. The software you're using doesn't run on your own PC, it runs on a distant server. The documents you're creating aren't saved on your local harddisk, but somewhere on the intarweb. The combination of the two presents a major shift of control away from you, an individual, towards a few giant global technology corporations.

That's scary. Read on for countermeasures.

Continue reading "autonomo.us cloud computing"

host-proof hosting

nospam@example.com (Guido Stevens) — Fri, 04 Jul 2008 21:13:00 +0200

Think a minute about the security challenges involved in creating a health-centered social network. Or, more generally, any web application that has to handle sensitive user data. What if the database server becomes compromised? How do you make sure that, even if the database is stolen, your users' secrets remain confidential? How can any cloud computing application provide any significant measure of privacy?

At Clipperz they claim to have found the solution: they call it "zero-knowledge web applications". Since the term "zero knowledge" has a precise meaning in cryptography, that's a bit confusing. What Clipperz promotes boils down to evangelism for the "host-proof hosting" AJAX programming pattern.

client-side encryption

You still with me? It's a very simple concept, actually. Encrypt any sensitive data on the client-side browser before sending it to the web server. Data is never stored plaintext. Users can retrieve their data, in encrypted form, and only in their private browser is it decrypted and becomes accessible. Should the database server be compromised, an attacker finds only encrypted gibberish in the database.

Wow! Total privacy in the cloud computing age! Why don't we rewrite all our web applications to use this neat trick? Yes, why don't we? Read on to find several answers to that question.

Continue reading "host-proof hosting"

the spam arms race

nospam@example.com (Guido Stevens) — Mon, 02 Jun 2008 14:53:00 +0200

The war on spam is mostly waged between spammers and ISP's, invisible to the public.

Earlier I wrote about greylisting. That's a fairly minimal change in handling email, that reduces the spam volume on our mail servers disproportionately. How can this be? Let's take a look at the economics involved.

Continue reading "the spam arms race"

fighting spam with greylisting

nospam@example.com (Guido Stevens) — Fri, 23 May 2008 16:51:00 +0200

At the NFG mail servers, we block about 10 spam messages for every valid email our customers receive. Even so, customers keep asking for more agressive spam filters.

Spam filtering requires a lot of system resources. Content filtering involves opening each message and matching its full contents against a database of spam patterns. This involves a lot of disk read/write actions and heavy number crunching.

In the graph above, our mail server was flooded with more spam than it could adequately handle. Of course, we could allocate more system resources or try and tune the server some more. However, the solution turned out to be much simpler: greylisting.

Continue reading "fighting spam with greylisting"

interfacing with the DBMail database

nospam@example.com (Guido Stevens) — Tue, 20 May 2008 11:34:07 +0200

Paul and myself have started a new DBMail blog.

Read the full blog entry @blog.dbmail.eu about direct database access versus protocol-mediated data retrieval.

Xen and EC2: make or buy?

nospam@example.com (Guido Stevens) — Fri, 16 May 2008 14:08:00 +0200

Virtualization is cool. Literally. Consolidating servers is a great way to reduce carbon emissions.

Running a multi-core Xen server nowadays is like having a mini-datacenter-in-a-box. Cramming a dozen logical servers into the rackspace and energy footprint of a single physical server, it's a geek paradise. And a boon for the bottom line.

So naturally, when Amazon keeps upping the ante in it's Xen-based EC2 (Elastic Cloud Computing) offering, that's a cool thing.

Which begs the question: make or buy? How does running your own server rack (make) compare to renting EC2 capacity (buy)?

Continue reading "Xen and EC2: make or buy?"

Amazon EC2 storage remains problematic

nospam@example.com (Guido Stevens) — Sat, 29 Mar 2008 12:01:00 +0100

Amazon CTO Werner Vogel's recent announcement of new high-availability features in EC2 (Amazon Elastic Compute Cloud) drew some attention. And indeed, being finally able to manage IP addresses for EC2 services removes one of the biggest drawbacks EC2 had until now.

Amazon reseller Rightscale even drew some nice diagrams explaining how the new EC2 features make renting a fault-tolerant hosting environment a breeze.

Some pretty interesting details got omitted somehow, though.

Continue reading "Amazon EC2 storage remains problematic"

howto sync mailman from plone

nospam@example.com (Guido Stevens) — Tue, 11 Mar 2008 18:09:00 +0100

Mailman is our mailing list software of choice. Even when using PloneGazette to format mailings, we prefer to use Mailman as the actual mail sender: it's faster, it has superior bounce handling, and it runs on our dedicated list server, outside our Plone environment.

Managing subscriptions for simple publication sites can be as easy as creating a MailManSubForm. However, if you have a full-fledged Member site you'll want to integrate mailing list subscription/unsubscription options as part of the member profile personalization experience in Plone.

We need to use the Plone Member database as master for the mailman database, in other words. This turns out to be quite easy.

Continue reading "howto sync mailman from plone"

trust in XFN social graphs

nospam@example.com (Guido Stevens) — Tue, 04 Mar 2008 00:00:00 +0100

XFN is vulnerable to relationship injection attacks, as discussed earlier here and there and elsewhere. Summary: If I create a malicious page and put a rel="me" link to your page, your XFN "identity" contains my malicious page and is therefore compromised. The same holds true for links to other people.

We can arm ourselves against such an attack by requiring that all links are bidirectional, i.e. reciprocated. This is, in practice, too burdensome. If you have 10 pages, you'd have to link to all 10 pages from all 10 pages to truly establish identity. If you have 20 friends with 10 pages each, they'd have to put all your 10 pages on all their 10 pages. And everyone would have to do that for everyone.

Continue reading "trust in XFN social graphs"

thundercloud computing

nospam@example.com (Guido Stevens) — Sun, 17 Feb 2008 20:57:00 +0100

Cloud computing is a big meme to wrap your head around. A good place to start is this video (go to tab "The Coming Cloud"), featuring amongst others Nic Carr, who wrote the book.

The free software community should be mightily worried about these developments.

A world in which most software runs in one of two megaclouds controlled by the likes of Google and Microsoft is the ultimate dystopia from a software freedom point of view.
Currently available open source cloud computing software is mainly funded by Yahoo!. A Microsoft takeover of Yahoo! can hardly be beneficial.
The web 2.0 / cloud computing / software as a service paradigm disrupts the social contract constructed by the GPL around software distribution - because it disrupts software distribution per se.

Continue reading "thundercloud computing"