Security Advisory for Flash Player, Adobe Reader and Acrobat

The summary is as follows:

A critical vulnerability exists in Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Macintosh and UNIX operating systems. This vulnerability (CVE-2010-1297) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against both Adobe Flash Player, and Adobe Reader and Acrobat. This advisory will be updated once a schedule has been determined for releasing a fix.

Now, the timing of this is mighty nice for Steve Jobs who’s under fire for not supporting Flash on the iPhone and iPad. But as someone who has to (try to) develop for Flash I can say I’m not surprised. Not by the security advisory nor by Jobs’ and Apple’s position. Flash player always crashes on me and it cranks up my CPU meters more than anything other than video conversion.

Don’t get me wrong, I love Adobe products – Photoshop, Illustrator, Acrobat – I don’t go through a day without them. There was a time when Flash was also one of my main axes. But no more. JavaScript libraries like jQuery can do many (if not most) of the things Flash has been used for up til now. Flash is a nightmare to develop in and lacks the immediacy of a true scripted environment (you have to compile the movie to see if it works).

Should Jobs have allowed Flash onto Apple’s mobile devices? From a pure market-share perspective: yes. But I can see where he’s coming from and being able to see some Flash-based sites at the cost of having your mobile device crash or lock-up isn’t a trade-off I’d really want to make for people.

Google added something new and slick recently – the ability to embed non-standard fonts in web pages as a web service called the Google Font API. It’s pretty easy to tweak a CSS file and your page headers to use this and there are about 15 or 16 font families to choose from ranging from fancy cursives to old-English style text. I added the following to my headers on my GonZoville site:

1
2

    <link href='http://fonts.googleapis.com/css?family=IM+Fell+English'
        rel='stylesheet' type='text/css'>

and then changed the CSS for the various headers to include:

1

    font-family: 'IM Fell English', arial, serif;

and voila, I have nice old-world style text in my article and sidebar headers. Awesome. For headers and the like this is a great way to do something fancy and/or unique without relying on a Flash-based plugin or off-screen rendering techniques.

I settled on Carbonfin Outliner as it did everything I wanted and nothing I didn’t.

For starters, the outliner works great. It has all the standard means of moving things around. Items can be just an outline bullet or have a check-box on them, to mark off tasks as they get completed. Even cooler on the check-boxes is that the parent item turns into a disc which gets more complete as you check things off. I’ve seen outliners that have the checkboxes, but you always have to expand a parent task to see how far along you are.

There are niceties like a “small fonts” mode, so you can see more text. You can store unlimited outlines on the app and the home screen allows the list of outlines to be reordered. Again, many outliners force you into sorted view, but Carbonfin gives you total control.

What I love most though is that there is a web-based app that’s a companion to the iPhone app – and the two auto-sync. The web-based app is almost identical in function to what you find on the iPhone, save for it’s mouse-and-keyboard driven and even more minimalist since your primary interface is, after all, the iPhone.

Coda

Espresso

Mac Dev Tools Worth Having

For a lot of people, the Mac is seen as the PC for a “creative person”. Very “artsy.” Now, I’ve spent years (decades) developing code on Sun workstations, DEC equipment, and PC’s – the Mac, and the tools that are available on it beat all that stuff by a wide margin.

For starters, Mac OS X is itself a Linux environment. So no more shoe-horning a WAMP environment onto a PC. It’s not needed (although I do use MAMP for the Mac because Apple chose not to install some of the standard PHP extensions as standard, but for most developers this may not be needed).

But what IDE does one run? Sure, you can install the ever-present Eclipse platform. Which is capable of pretty much anything and everything if you locate/install/configure/incant the right stuff. For me, Eclipse was just too much work to get running, too slow, and too idiosynchratic to use on a daily basis.

Thus enters Coda, by Panic. Coda combines a solid code editor, a rock-solid FTP client, a terminal, a CSS editor, Subversion, and site management in one package. If you code in Rails or work with CMS-based sites, the inclusion of a SSH terminal which remembers passwords is a life saver. No more neededing to reach for Terminal or iTerm when you need to launch mongrel or change some folder protection – just open a tab, hit the button and you’re in.

Subversion support is a recent addition to Coda and it works well. I still find it more reliable to do high volume operations from the command line, but for ongoing code changes the way Coda shows you what’s changed and what needs to be added to your repository is pretty damn good.

Coda also supports multi-file search and Regex search. Both of which can also do replace. You don’t appreciate the value of these features until you need them. There is also support for snippets and the latest major release also supports plug-ins. So the text-manipulation capabilities of Coda are now able to grow beyond what the Panic developers have time to do. Coda supports FTP and SFTP and allows for live-editing of a site’s files right on the server. This is also something one doesn’t appreciate until one needs it.

For $99, Coda is a solid investment. I’ve built everything from small client sites to medium sized WordPress and Joomla CMS sites to very large PHP-mySQL and Rails sites with it, and Coda has come through every time. I have never hit a case where I had to say “it won’t let me do that” on something I was working on. Which is what an IDE should be able to claim.

But …

There are a lot of times where I need to do a small site for a client and I don’t need a big IDE. I need something small that can deploy the small site to possibly several domain installations (for proofing or mirroring). I still want to be able to edit and browse the files on the server, but I don’t need the project management. And it has to be fast.

The latest MacHeist served up Espresso, by MacRabbit (makers of the excellent CSSEdit). Espresso uses project files instead of a built-in project manager … which is actually what I wanted since the number of projects I have floating around kind of overwhelms Coda’s interface. Rather than use conventional tabs, Espresso uses a list of open files and previews. This takes a little getting used to, but it actually works better than tabs once you gave more than a dozen files open.

As expected, the CSS editor is great in Espresso. The code editor is also very good, with inteligent tag completion and all that good stuff. The system is extensible by “sugars” so as this gets into more developers hands I expect the language support to continue to improve, much as it did with TextMate.

Snippets are supported, but no Subversion. Which is OK for what I intend to use this for. I don’t mind firing up a SVN client every few days as the need to check in isn’t as high on smaller projects. The FTP support is one thing I really love about Espresso. You can define multiple FTP sites, so you can deploy to your staging server, the client’s server, and potentially other servers as well (mirrors, portfolios, etc. etc.).  You can also browse and edit in place for each FTP desitination, which is great for quick touch-ups.

I did have a few FTP connection problems with Espresso when I was working from a hotel, Coda worked like a charm. But that was Espresso 1.0.1 … MacRabbit made stability improvements since that release, so I expect those problems are gone now as well.

At around $80, Espresso is a little on the pricey side compared to Coda. Coda simply does more and lists for only $20 more. Had I not gotten Espresso as part of the MacHeist bundle, I might not have bothered with it. Which isn’t a knock on Espresso as a product, just that for the list price it’s hard to justify not getting Coda instead. If Espresso was closer to $40, it’d be a no-brainer to get it in addition to Coda.

When one steps back and looks at Facebook and MySpace, and view it as a “network” one can indeed see that it is a vast set of connections from one person to another, or many others. It is a network much like the streets of a city … it provides the means to get something from one place to another; or like a phone book … you can look up anyone you may want to find and contact them.

This is basically a “passive” network. When you really boil these services down, they are a place to put “stuff” where other people can find it, and a place to find other people’s “stuff.” Anyone who uses these still needs a phone, email, IM, TXT-messages, RSS readers, a Twitter client, and so on. So, the actual real-time networking between people is actually carried out outside of the social networking sites.

For the genre to advance this is the wall that needs to be broken down. The next social networking revolution will bridge the gap between active and passive content and communications. Does this mean that the next social networking site needs to encompass all these various kinds of real-time communication? Possibly – or possibly there will be a convergence of digital communications which will enable this transition. Consider services like Meebo which already aggregate IM, or the various desktop clients which already aggregate Twitter and RSS.

In fact, Twitter may be the preview of this new means of networking. Consider that a Tweet is content which is posted for public view, yet it can also be private to an individual (a threaded reply). The same datagram, but used two different ways and more or less residing as the same object within the server. Taking this to the next level, consider being able to post to the “Frodus” … a nonsense term I like to use. You can post an article with a category and/or tags. You can post in response to something for public view (like a comment). You can post a message intended only for one person, or a list of people (like mail/mailing-list). You can decide on the expiration and/or publish date of the item. You can post and read from your smart phone, and be notified on any place you’re logged in of new activity. You can present content you want to be view by the public in a template-driven presentation which mimics the current blog/CMS. And other people can aggregate things you post as well … so if you post an article about wanting to sell your old computer, someone out there has a site which looks for those kinds of articles for their classified site.

That’s active networking. That’s where we’re heading some day.

Now, if you’re some big shot VC with gobs of money … call me … the time is Now!

Now fast-forward a couple of years. Our provider starts to have some performance issues, one of which ends up costing us half a week of down-time to move our server image to a new physical server. Support starts to get slow and, while responsive, we get the impression that they’d rather we figure stuff out on our own. They have great technology and, if we were a large company with a full IT staff, it’d be great fun to play with.

But we’re not. We’re a small outfit where everyone does 3 or 4 or 20 jobs and messing around with complex server configurations is simply not good for business. Every hour one of our developers spends trying to configure the server is an hour they’re not spending writing code.

So we just recently moved the whole deal over to Engine Yard. In a word, I was astounded by the reception we received. For starters, their slice hosting comes with free accounts on GitHub (Git hosting), Beanstalk (SVN hosting), Lighthouse (ticket/project-management system), and New Relic (application analytics). So basically all the services we needed, or were paying for elsewhere, were now included in our basic hosting fees. Email is hosted on MailTrust – which works pretty well, even though it’s based on a Microsoft platform. But using MailTrust we can suddenly send email to people on AOL, so that’s a good thing.

Freebies aside, the real impressive event came when I started moving stuff over. A lot of the administrative chores and other minutia are handled by the EY staff. Submit a ticket to change a DNS record, install an application, or whatever and they handle it for you. Tickets get answered within 10 minutes with at least an acknowledgment. EY provides you with all your login credentials for you slices, static IP address ready to roll, and environment files for running Capistrano deployments. Outside of learning how to use Capistrano, it couldn’t have been much easier.

As I started getting our application running, I hit various configuration issues along the way. Mostly this was due to gems not being installed but sometimes it was things in our code which had to change. At one point I hit a problem which just baffled me. Rails was saying a class wasn’t defined when clearly it was. I threw the problem over to EY and an hour later they told me what was wrong. It was a configuration problem because we didn’t have a “staging” environment on our prior hosting setup – the missing setting was ultimately what was causing the class to not load (sure would be nice if Rails gave a more useful message, huh?).

What was really amazing was the EY tech’ spent an hour going through our code to find the problem. He could haev just spouted some canned answer from the KnowledgeBase (which is what I’m used to from ISP’s). But no. He actually analyzed our code and found a very subtle problem and told me how to fix it. That’s nothing short of amazing from a support organization. Imagine taking your new car back to the dealership and telling the service manager that you’re having trouble down-shifting into first and, rather than throw a “Driving For Dummies” book at you, he comes out from behind the desk and teaches you how to heel-and-toe downshift.

Jim Clark at the 'Ring

Once the gems were all installed and the configuration problems worked out. The application fired up on Staging just fine. Then simply install the same gems on the Production slice, copy the latest database image, and “cap production deploy” from my MacBookPro and – bingo – we’re running on a new host. I flipped the DNS a day later, EY made the necessary additions to their nameservers within 5 minutes of my ticket informing them of the move.

Just awesome. So, the bottom line is that if you’re looking for Rails hosting and want everything you need to deploy a commercial application from one vendor, plus incredible support, at a reasonable price – you just can’t beat Engine Yard. With their support it’d be a bargain at twice the price because you don’t need to hire an IT guy to manage the servers.

Being able to turn any tab into a launchable desktop application is also great. It means I can now retire Prism from my Windows machine as Chrome does a better job – especially on GMail, Google Docs, and so on – go figure.

The minimalist interface gets in the way in some cases – like trying to figure out how to manage bookmarks. And if you’re used to the features you can end up with in Firefox once you load up all your add-ons, Chrome may be a downer. Because it does what it does – it does it fast and reliably, but that’s all it does.

But that isn’t bad. Use Firefox when you need your add-ons for downloading video or inserting BB-codes into message boards. Use Chrome for your web applications where you want them launched fast and you don’t need anything else getting in the way.

The one huge, huge problem with Chrome … it’s Windows only. Of course, this makes sense given the market share of That Platform. But still. The ‘Net runs on Linux and most of the best design work is done on the Mac. The opinion-makers don’t like on Windows 24×7. I’m sure Google will correct this.

In summary, Chrome is the ideal browser for accessing web-based applications (version control, project management, email, billing systems, and so on). It’s worth a shot and, while it may not take market share away from Internet Explorer, every user who can be lured away from it can be considered a “win” for web designers.

Enter “ShoveBox“, a great little menubar utility which keeps all this stuff close at hand. There are a lot of clipboard managers, but ShoveBox’s “Organize” window makes the difference. It allows all the clipping to be organized and colorized any way you like. This makes it real easy to track down that Subversion command for creating a branch you only use once or twice in six months – and then just drag-paste it into your terminal window.

Also, unlike many pure clipboard applications, ShoveBox allows you to create blank notes and put whatever you want in them. This is very useful when the text you want to paste is a combination of things – maybe some subversion commands follows by some Ruby on Rails commands – or maybe a signature for a BBS with contact information and a whitty quote.

Twenty-five dollars may seem a little steep for something like this, but the aggrivation it can save over the course of a few months is worth it. And there’s always the chance to get it at a bargain on one of the many Mac software daily sales.

This was an 80% rewrite of the old code-base. Some thought was given to going to a full-fledge PHP framework stack, but instead we opted to keep things light and simple. The Smarty template engine was used to handle the “V” side of an MVC application. This also benefited the application by providing a nice view-caching mechanism to increase performance.

Adodb’s ActiveRecord implimentation was used for the “M” part of the design. This put everything on a nice, solid database model which would also allow for migrating to some other platform should the need arise.

Throw in a splash of JQuery here and there, and some other JavaScript controls and voilà.

The first cut over went pretty well, aided by the “MAMBO2WORDPRESS IMPORT WIZARD“ script by Rodney Blevins which – with some modifications for table names and the like – at least allowed me to get the primary content into WordPress.

It will likely take another week or so to get everything settled in, and finalize the plugins – but then I should be able to get back to writing about technology. Some topics I plan to cover soon include:

• Reviews of the Mac web design packages RapidWeaver and Sandvox.
• A look at the “big three” content management systems – well, at least as far as I see it, anyway – Drupal, Joomla, and WordPress.
• Some of the new Web 2.0 sites I’ve been beta testing.