Posterous
Richard is using Posterous to post everything online. Shouldn't you?
Phi_squared_thumb
 

phirate

Contains caffeine, guarana and traces of nuts

Pretty by default

Ok, I've done the rounds now. All of the python web frameworks (and
possibly all of the open source ones - that's a bit too large a task
for lil ol me) are failing miserably. We're almost at 2010 people, and
I'm NOT HAPPY.

The idea behind a web framework is that it offers the basic services
that almost any web application needs. Obviously we're talking about a
90/10 rule here - every now and then the web app you're trying to
build is going to be a bit weird, and so you'll have to do some extra
work, maybe install a plugin, probably write some stuff yourself. But
the idea is that the web framework covers off the 90. More
importantly, the idea is that it covers it off *well*. There is no
point having a web framework full of crappy implementations, because
it just means that either a) shit sites get released with it or b)
people end up doing so much work installing plugins or whatever that
they may as well have started from scratch.

In the old days (2007) we were still trying to figure out a lot of the
basic ideas about how to integrate javascript into sites, how to deal
with CSS, authorization etc. We've done that now, we know how to do a
decent job of it. Yet all of the web frameworks are busy pretending as
though nothing has happened. Along the same vein, a great deal about
UI has become standardized over the last couple of years - we've got a
whole library of widgets that don't come with HTML by default, but
which are vital for a good implementation of many sites.

And then there's design. Maybe it was ok in the 90s to have the first
run at your web app come out looking like something carefully targeted
at NCSA Mosaic, but that's not the case any more. We're in a hurry, we
have a lot of solid apps to put together, and many of them are
in-house or administrative applications that don't require the
services of a graphic designer (not that they wouldn't benefit, as we
constantly tell our customers, but there's no budget so that's that).
The web frameworks really need to step up here, because at the moment
the stuff they're pushing out by default looks like garbage, and worse
there's no reason for it to be so.

So, how specifically are we failing? let me iterate the ways:


Client-side form validation

This is no longer a debate. Yes, you must validate your data
server-side, always. But we're in 2009 now, there is almost no
validation that you should not be able to perform on the client side,
including validation that has to make callbacks to the server to
verify (like username availability). It's too easy to get this stuff
wrong, it needs to be right there in the framework.

Widgets

Calendar selectors, themeable select widgets, wysiwyg textareas, tag
entry boxes, upload fields with progress indicators, shuttles, ratings
controls - all of this and more needs to be in there by default with
appropriate validation. Standard UI widgets like accordians, tabs,
modal dialogs, and basic charting all need to be in there as well.

Form capabilities

Forms need to be able to be specified in some useful programatic way,
rather than spending your life screwing around with markup. Markup
should be easily doable in the event that one or two forms need
special work. Validation needs to integrate with the client side
automatically - an Email() validation should be validated in the same
way both client and server side (without ajax callbacks unless
necessary). A variety of form modifiers need to be in by default:

Duplicate/remove form sections (repeaters)
Show/Hide form sections on conditions (including automatic validation
management)

In addition, the web framework should automatically and transparently
implement XSRF defenses.

Identity sessions

(see http://phirate.posterous.com/the-complete-identity-session-checklist
for a starter list). There is no excuse for not getting this stuff
right anymore, all of the listed requirements should be in there and
set to secure settings by default.

Icons

Icons are recognized as a vital part of the UI interface now. All web
frameworks should come with an iconset that covers the basic web
tasks, and use those icons appropriately within widgets. There's no
excuse for this, web app interfaces that are full of nothing but text
are difficult to read, it's not a debate, it's a fact, fix it.

Buttons

I don't care how pretty the default buttons in Safari on OSX are,
they're not good enough. Designers have gone out there and solidly
proven that you need at least three classes of form button (accept,
should be greenish, reject, should be redish, cancel, should be
greyish). If the web framework doesn't supply a way of specifying
those buttons in its forms, if it doesn't provide the CSS and
javascript necessary to make those buttons appear using simple markup
and degrade gracefully, then it fails.

Design

Finally, every damn thing about the framework needs to use a
consistent CSS schema. This schema should be easy to read and modify,
and may optionally require the use of a basic grid framework. Some
widgets, such as charts, that may need non-CSS configuration related
to their look and feel should provide configuration files for this.


There are a million other things that need fixing, but this is a start
and at least would get us to the point where we're not looking like a
bunch of rank amateurs.

Quick note: If you're thinking of posting a comment that involves the
word "plugin" (or for pylons people, "template"), just don't. I don't
care, plugins are for optional extras, not core-critical things.

Quick note #2: This post is not entitled "Beautiful by default".
Beautiful is what you get when a talented designer does their thing on
your code. Pretty is the best we aim for by default.

Loading mentions Retweet
Posted November 27, 2009
// 0 Comments

Trampoline dodgeball

I want I want I want I WANT.

 

update: Turns out it's a place called Skymania in LA/St Louis. More here: http://www.youtube.com/watch?v=7uFZWRQOkHU&feature=fvw

Loading mentions Retweet
Posted November 17, 2009
// 0 Comments

StarCraft AI Competition | Expressive Intelligence Studio

The Expressive Intelligence Studio at UC Santa Cruz will be hosting a StarCraft competition:

This competition enables academic researchers to evaluate their AI systems in a robust commercial RTS environment. The final matches will be held live with commentary. Exhibition matches will also be held between skilled human players and the top performing bots.

Awesome!! I'd love to have time to dig into that, it'd be great!

Loading mentions Retweet
Posted November 13, 2009
// 0 Comments

My talk

A talk I gave at Kiwi PyCon 2009 about Simplicity. I need a lot of practice if I'm going to do any more talks :)

Loading mentions Retweet
Posted November 9, 2009
// 0 Comments

Teach cracking

I'm going to just come out and say it: I believe we should teach cracking (hacking) to programming students.

The reason is simple. We are not getting through. There is too much code being released out there by people who clearly have no idea what threats exist to their code. It's kind of like cryptography - Just because *you* can't see a way to break your caesar cipher doesn't mean the rest of the world can't do it in ten seconds flat.

You'd never trust a crypto algorithm designed by a grad student. For that matter, we don't even trust implementations of completely well known crypto algorithms by random people because there are just so many subtle ways you can trip up. Hell, Debian did some innocent patch to openssl to fix a compile bug at one point and *completely broke it* and nobody noticed for ages. This stuff is hard.

NASA have it right (or did, I don't know about now). Programming should involve an adversial testing component. You need people trying to break your stuff to catch these things. In most projects, you can't afford a dedicated team of crackers so you need to have the team members capable of breaking each others code themselves.

I think that, until you've thrown up code you're *sure* is safe and had someone go through it like swiss cheese, you're really not cut out for programming on the net - make no mistake, this is a hostile environment and the leverage of software means it only takes one smart cookie who knows how to break your gear for it to become a serious problem.

It's time to get serious - just teaching people defensive techniques without solid experience in *why* isn't working. We should be teaching how to break in, and every dev organisation should be building in time to take their sneakiest people and attack their own apps before deployment. We won't get everything, but it's a start.

Loading mentions Retweet
Posted November 9, 2009
// 0 Comments

Web approaches from #kiwipycon

The #kiwipycon conference in Christchurch has inspired some interesting thoughts. If you had asked me prior to this conference, I would have told you there was one efficient, sane way to build web applications under python (for a normal set of constraints), with a few mild variants depending on precisely what issue you were dealing with.

This was the result of having been building these things for 3 years now and thus experienced the majority of what python web frameworks and their constituent components have to offer under the pressure of productivity and performance requirements.

Coming out of pycon however, I'm no longer sure things are quite that simple. There seem to be three basic classes:

1. People who just aren't doing things I do - this includes everyone who is basically doing a heavy duty CMS. These people are generally using plone/zope
2. People who are replacing MS Access - that is, their problems are very simple and all they're really doing is dealing with objects in a simple fashion. These people are generally using django
3. People who haven't been operating under prod/perf pressure - that is, their gear is wildly inefficient in a number of ways but they don't care (or don't even realise) because their objectives are different (in some cases, organisational more than anything else).

Interestingly, almost nobody I was talking to was actually dealing with the kind of scenario I deal with regularly - high productivity, heavy performance problems. As a result while I was doing my bit to evangelise what I saw as more efficient and professional ways to do this stuff, I didn't really get a chance to get into it because it was clear that those weren't actually the problems people were facing.

It will be interesting to see where things go over the next few years, as the various web services that are doing "MS Access replacements" start encroaching on the django space, and as we complete the shift happening now from threaded servers to evented servers a lot of what we're doing with our existing frameworks will fall aside in the face of new, more efficient methods that get drafted in with the new generation.

Exciting times.

Loading mentions Retweet
Posted November 7, 2009
// 0 Comments

Archaic processes

Short-circuiting inefficient processes is part of the game, right?

I will be presenting at the Kiwi PyCon this weekend, I'm in the Saturday, 11:15AM slot on Track 1 ( http://nz.pycon.org/talks-cfp/schedule/ ). 

Title: The Living Coder
Summary:
"What are you doing?", asked Minsky.
"I am training a randomly wired neural net to play Tic-tac-toe", Sussman replied.
"Why is the net wired randomly?", asked Minsky.
"I do not want it to have any preconceptions of how to play", Sussman said.
Minsky then shut his eyes.
"Why do you close your eyes?" Sussman asked his teacher.
"So that the room will be empty."
The understanding of the fundamentals of programming is never complete without an understanding of the fundamentals of programmers. 

The purpose of this talk is to encourage us to open our eyes to our own psychology, motivations and social environment, and the impact they're having on our lives and on our code. It sounds pretentious but hopefully it'll be fun and interesting instead.

More information on the subject will be added to this blog over time under the tag http://phirate.posterous.com/tag/livingcoder

Loading mentions Retweet
Filed under  //   livingcoder  
Posted November 2, 2009
// 0 Comments

Start-up studies: A pop quiz

Presenter is a bit too cheery, but the concept is great. 4-5 days to plan, 2 hours to execute, $5 in "seed money". Object: to make as much money as possible. Winning team managed US$650 by going way outside the box.

Loading mentions Retweet
Posted October 30, 2009
// 0 Comments

#oneletteroffmovies

I have been watching the crazy #oneletteroffmovies trend since I got home earlier today, and it's just insane fun - myself, serra and a friend were sitting here throwing out ideas for more than an hour and laughing ourselves silly. As part of that I really wanted to be able to see some of the best ones, since there were a lot of repeats and a fair amount of chaff.

So I threw up a site on http://oneletteroffmovies.com/ - it has a Top 100 as well as a nice realtime feed that delivers at a speed that's readable without going too fast.

once it had been up fora bit and I got the kinks out, I started to wonder if there was anything else useful I could do with it. It occurred to me that the names that had been coming up often looked really good for quirky company names or domain names, so I figured I could do an export or feed of it. Didn't wanna get my bandwidth bill blown out so I put it behind a paywall but it's instant-fix so who knows, might make a dollar or two into it.

But screw that, if nothing else, you should absolutely go read some of them and post a few yourself on twitter. It's like having a drinking game with the whole planet.

Loading mentions Retweet
Posted October 24, 2009
// 0 Comments

Oli Lemieux training trampoline wall Dralion Cirque du Soleil

Awww it's not fair!

Loading mentions Retweet
Posted October 19, 2009
// 0 Comments