The Scale of the Universe - An Interactive Flash Animation

The Scale of the Universe - An Interactive Flash Animation:

'via Blog this'

Hiring a gardener

After 7 years in our house, and roughly 6.99 years spent ignoring our garden, we finally decided to get a gardener in.  Within the first 3 hour session he'd already uncovered 3 fence panels in the back garden which we'd never seen before (they'd been covered in crawling plants growing over from next door).  I'm now looking forward to seeing how our garden should look, without putting any actual effort in.

So, if you're in the Thanet area of Kent, and looking for a well priced, competent gardener, check out Albion Gardening

The Pass Lane Driving School redesign

I've just pushed a major redesign of my wife's driving school website live. The old site was done 3 years ago and was looking a bit tired. So if you're looking for Driving lessons in Ramsgate, Margate or Broadstairs, check it out and let me know what you think!

Sorry Google; you can Keep it to yourself — Tech News and Analysis

What he said.

Sorry Google; you can Keep it to yourself — Tech News and Analysis:

'via Blog this'

Implementing OpenID authentication with Cherrypy

Originally published: 2010-05-09 on my old blog

Seeing as I've just spent most of the weekend trying to get OpenID authentication working on richbeales.net, I thought I'd share how I did it, and some pitfalls I encountered along the way.
Installation was easy, and the documentation on both OpenID and python-openid is reasonably good, however there seems to be a lack of sample code.  API references are all well and good, but they don't show you *exactly* how it should be done.
So, for anyone attempting the same thing, I'm going to reproduce the relevant sections of my login script for Richbeales.net so that others don't have to waste their weekends. 
Firstly, you'll need to install python-openid itself, which seems to be quite well distributed, so on my debian-based system, this was as easy as "apt-get install python-openid".  So, with that installed, and your website already up and running with Python and some sort of web framework (Cherrypy in this case), you'll need to do something like the following:

#! /usr/bin/python
import cherrypy, logging
from openid.consumer.consumer import Consumer, AuthRequest, SuccessResponse
from openid.store.memstore import MemoryStore
class Login(object):
def __init__(self):
self.store = MemoryStore()
self.returnurl = ''
@cherrypy.expose
def default(self, *args, **kwargs):
if len(args) == 1:
self.returnurl = args[0]
return self.PrintLoginForm()
@cherrypy.expose
def index(self):
return self.PrintLoginForm()
@cherrypy.expose
def do(self,openid_url='',returnurl='',loginsubmit=''):
self.returnurl = returnurl
consumer = Consumer(cherrypy.session, self.store)
username = self.FormatUserName(openid_url)
cherrypy.log('initialised consumer', context='', severity=logging.DEBUG, traceback=False)
auth = consumer.begin(username)
cherrypy.log('begin called', context='', severity=logging.DEBUG, traceback=False)
auth.addExtensionArg('sreg','type.email','')
newurl = auth.redirectURL('http://*.mysite.com','http://www.mysite.com/login/verify')
cherrypy.log('redirect called to '+ newurl, context='', severity=logging.DEBUG, traceback=False)
raise cherrypy.HTTPRedirect(newurl)
@cherrypy.expose
def verify(self, *args, **kwargs):
try:
cherrypy.log('verifying ' + str(args) + str(kwargs), context='', severity=logging.DEBUG, traceback=False)
consumer = Consumer(cherrypy.session, self.store)
completedict = {'openid.mode':'check_authentication'}
for k,v in kwargs.iteritems():
completedict[k] = v
result = consumer.complete(completedict,'http://www.mysite.com/login/verify?janrain_nonce=' + completedict['janrain_nonce'])
if type(result) is SuccessResponse:
cherrypy.log('complete success' + str(result.signed_fields), context='', severity=logging.DEBUG, traceback=False)
username = self.FormatUserName(result.identity_url)
#
# Do your site-specific login here
#
return self.PrintSuccess()
else:
cherrypy.log('complete failure ' + str(result), context='', severity=logging.DEBUG, traceback=False)
return self.PrintFailure(result.message)
except Exception, inst:
cherrypy.log(str(inst), context='', severity=logging.DEBUG, traceback=False)
return self.PrintFailure()
def FormatUserName(self, usrname):
return usrname.strip().replace('http://','').rstrip('/')
def PrintSuccess(self):
return "<a href="/%s">Proceed</a>" % (self.returnurl)
def PrintFailure(self, extrainfo = ''):
return "Failed to log in - auth failed %s <a href="/login/%s">Try Again</a>" % (extrainfo, self.returnurl)
def PrintLoginForm(self):
return """
<p>Please log in using OpenID</p>­
<form action="/login/do" method="post">
<label for="openid_url">Your Open ID: </label><input name="openid_url" id="openid_url" style="background: transparent url(/img/openid-inputicon.gif) no-repeat" type="text">
<a href="http://www.openid.net">Get an Open ID</a>
<input name="loginsubmit" value="Log In" type="submit">
<input name="returnurl" value="%s" type="hidden">
</form>
""" % (self.returnurl)

­
One thing that tripped me up for a while was the "realm" parameter to auth.RedirectURL, I was simply putting "mysite.com" whereas the real answer was "http://*.mysite.com", again not something you'll find out just by reading the API docs.  Obviously replace mysite.com with your own domain name whereever you see it.

I've still got a little way to go (like retrieving nicknames and email addresses from the OpenID provider), but the above will certainly work for authentication.  Good luck (and let me know if you can help with the email retrieval!  Cheers.



­

Why use Vim?

Originally published: 2010-03-21 on my old blog

Why use Vim?

Some of you may have stumbled upon posts saying something like "real programmers use Vi or Emacs", so let's have a look at why anyone today would want to use a 30 year old editor.

For the purposes of this article, and personal preference I'll concentrate on Vi rather than Emacs - the war between those two factions is another book on its own.

History:

Vi (pronounced vee-eye) was born in 1976, by Bill Joy, who was looking to create a useable multi-line editor for the Unix operating system and its main successor, Vim (Vi Improved) was born in 1992, written by Bram Moolenaar. Vim improves on Vi by adding many new features, especially those to support programmers (such as syntax highlighting), as well as being almost completely backwards-compatible with Vi. Vim is free, and open source software, although users are encouraged to donate money to Uganda by registering/sponsoring Vim - a model known as "CharityWare".

Why does it matter?

If you spend any significant time at a computer dealing with text, and you are a good typist, you will almost certainly benefit from using a more advanced text editor. Many of the people reading this article are likely to be using a computer and editing text around 8 hours a day. In other words even if you only get 10% better at manipulating text, you'll gain nearly 300 hours more spare time every year just by improving your editing skills. Vim is also completely keyboard driven, so you will save time and risk of injury by not constantly swapping between keyboard and mouse for selecting text and navigating the cursor. It's this improvement that I think is worth the steep learning curve of an editor like Vi.

What's wrong with my normal editor?

I'm not going to stand up and say that whatever you're using now is useless and terrible, because it probably isn't (unless you're still using Notepad of course! - in which case at least try NotePad++). Most modern editors also support syntax highlighting and autocompletion for many programming languages, however Vi has matured over many years, and is almost infinitely extendable and customisable. You can also almost guarantee that whatever system you use (or are forced to use), it'll either have Vi or Vim installed, or it's a short download away. One of my main reasons for learning it was wanting a common set of skills I could guarantee i'd be able to use anywhere, on Windows at work, on Linux at home, and over SSH to my hosting server. Vi has also taught me more about regular expressions, which have helped me many times in my professional life.

What does Vim do?

Among many other things:

• Supported on almost any operating system
• Syntax highlighting for hundreds of different programming languages
• Repeat any action using the '.' key
• Powerful regular expression support
• Excellent integrated help system
• Ability to interact with the command line without leaving the editor
• Multiple cut and paste registers
• Infinitely extendable and customisable

If you want to know more, take a look at Vim in 6 Kilobytes, Why oh why and the Vi lovers page

So how does it work?

Vim is different to most other editors because it uses a concept called 'Modal editing'. This basically means that keys on the keyboard carry out different functions depending on what mode you are in. The two main modes are 'Insert Mode' (allowing you to enter text like any other editor), and 'Normal Mode'. Normal mode is the default mode which Vim will start in, and it allows the keys on the keyboard to carry out various cursor movements and functions without having to resort to the mouse and to toolbars and dropdown menus. From normal mode you get get into insert mode by pressing the 'i' key, typing text and then pressing Esc to get back to normal mode. This was done for two main reasons, firstly a lot of early keyboards didn't have separate cursor keys (and even if they did you have to take your hands off the keyboard to press them), and secondly the recognition that when editing text, especially source code, you will tend to spend over 80% of the time reading and navigating through the code, and only a short amount of time actually entering new text. I'm not going to type thousands of words teaching you every command there is, as many people (not least of all the integrated help - type :help to get to it) have already done it.


You won't be able to pick up these commands and be productive with Vi after just a few hours, or even master it in a few weeks, but the pay-off is huge once you have mastered the basics. For some examples, see the videos here, here and here, the quickstart / cheat sheets here and a whole book here.

Integration:

Once you get used to using Vi/Vim you will find it quite difficult and frustrating if you need to edit text without it. Several products have been made to address this, including ViEmu for Visual Studio, and even a Vi Mode (Vimperator) for Firefox. These allow you to interact with other applications using most (but not all) of the niceties you're used to in Vim. The person who wrote ViEmu also offers products to integrate with Microsoft Office and Outlook. You can also use the "It's all text" plugin for firefox to allow you to edit in Vim straight from the web.

Emacs vs Vi

I won't go into it too much, but Vi is typically smaller and faster than Emacs, and is installed by default on more systems. Emacs has more of a "kitchen sink" feel to it, and I feel some of its keystrokes are particularly difficult (for example the long stretch to press Control-Y to paste text). However having said that, Emacs is also very powerful, and if you can't get on with Vim it's definitely worth a try.

Summary

These are the reasons why I have chosen to invest time in learning this editor, and hopefully I'll have convinced a few of you to do the same, or at least give it a try. You will only really appreciate the power of Vim when you watch an expert editing with it, see the videos linked above for a good example. Oh, and if you can't yet touch type, you'll be far better off learning that first! Enjoy.

How best to manage passwords

Originally published: 2010-03-17 on my old blog.  Superseded by http://blog.richbeales.net/2012/02/lastpass-or-keepass.html

How do you keep track of them and remain secure online?

This is an issue that everyone with internet access will have come across, although some may have sat down and thought about it more than others.  I'm betting that you have at least half a dozen passwords to remember.

Single password?

Many people will use a single password for all the sites and accounts that they access.  This makes it easy to remember, but is insecure because if just one of the sites is broken into, your username and password details will potentially be available not just for that site, but for everything that you access online.  Using a separate password for each site is the ideal solution, but few people will be able to remember more than 6 or 7 passwords.  Company requirements for changing passwords every 90 days complicate this even further.

Password strength and length

More and more websites are enforcing stricter rules on how long your password must be and whether it needs to contain any numbers or special characters.  Nearly all sites will mandate passwords that are 6 characters long.  The longer a password is, the more difficult it is to guess or crack.  One of the most common brute-force attacks is called a dictionary attack, literally trying each word in the dictionary in turn hoping to find a match.  Even substituting numbers or symbols for letters will easily be cracked, such as p455w0rd.  Of course the longer and more complex you make your passwords, the more difficult to remember they become.  Another trap that many people will fall into is using personal information as your password, such as a pet's name or favourite singer.  This information can be extracted from you using social engineering, and in many cases, with the likes of facebook around, you've probably already divulged this information online anyway!

'Static' or generated passwords?

If you choose to "manage" and store your passwords properly, there are two options, the first one is having a password protected (or encrypted) list or database of passwords, that way you only have to remember one password (to access the database), which then gives you access to all your passwords.  There are several examples of such software freely available on the Internet, two of the best are Keepass and Password Safe.  The other advantage to these pieces of software is they allow you to store a notes field (such as the memorable information some sites require if you ever forget your password).
The second option is to have a piece of software which generates your password for you, such as PasswordMaker.  This software allows you to use a relatively simple and easy-to-remember master password, it will then use this master password, together with the domain name of the site, and half a dozen other pieces of information (such as which characters are used in the password), as these are kept secret and all the pieces of information are combined (hashed) together, it becomes near impossible to get back to your master password and break into your other accounts.

A big disadvantage of this is the all-your-eggs-in-one-basket problem - if you lose the "master" password, you've lost everything.  To get around this, several of the tools mentioned allow you to export your passwords to a text file, which you can then print out.

Multiple computers 

Now all of these solutions are great if you only ever use a single computer for accessing your accounts, but most people will have two or more, for example, your work computer, your home computer and maybe a laptop too.  You then have the hassle of maintaining seperate databases, or trying to keep one database 'in sync' with one another.

How to get to your password safe in the first place?

Now many of you may have spotted a problem with all of this...  how do you log onto your computer if you don't remember the password (because it's in your password safe and you're not logged in yet!)?

This is a question I don't really have a satisfactory answer to.  One of the solutions would be to write your passwords down on paper, but we've all at one-time-or-another been told this is a bad idea.

Writing your passwords down

Why is it perceived to be such a bad idea to write down your passwords?  Actually, having your passwords written down isn't such a terrible idea, if they are locked away in your house.  A common or garden burglar is likely not interested in your passwords, even if he knew where to find them, and the number of people with access to your house is vastly less than the number of people who can get to an internet-connected computer.  As long as they are kept safe, this method is an ideal back-up to the electronic solutions.

Solutions

Some companies and websites are starting to introduce measures to increase the security of their customers, such as two-factor authentication, single sign on, and one-time passwords.  One-time passwords are self explanatory, two-factor authentication increases security by (typically) using something you have (such as a keyfob which generates passwords) as well as something you know (your password).  Single sign-on is perhaps the best idea, but it requires every company or website to sign up to the same idea/technology.  One of the most promising is  Open ID.  

To conclude, there's no right answer to this problem, but there are several pitfalls and wrong answers.  Staying safe online requires a little bit of effort, but with passwords giving access to such important information as your online banking, it's worth the effort.  If you've got a solution you use, please share it by adding a comment.