Category Archives: Computers & Technology

Great Dieter Rams interview

Dieter Rams, legendary industrial designer from Braun in the 1950s and ’60s, pretty much invented my design aesthetic. I can’t imagine what the world of technology would look like without his pioneering work. Brilliant.

I especially like his design principle #10: “Good design is as little design as possible.”

I probably didn’t hear of Dieter Rams until about ten years ago, but I’ve seen the world through his eyes since I was a kid. Most of these Braun products were not readily available in the U.S. in those days (the late ’70s and early ’80s), but their designs were so influential that just about everything you could get here still looked like them, or pale imitations thereof.

Jason Kottke also tidily sums up Rams’ influence on modern industrial design:

And hey, I didn’t know that a book had been published on Rams’ work. I bet Jony Ive has at least three copies.

I’ll take one of everything, please.

Source: Monoscope via kottke.org

CakePHP and the Session.timeout SNAFU

As I’ve mentioned before, my CMS, cms34, is built on the CakePHP framework. I love CakePHP, but it’s not perfect.

A client contacted me last week, reporting that customers using her website — specifically, a complex form that might take 30 or more minutes to complete — were having their sessions timeout during that process. Now, yes, you may point out (and you would be right) that this is an excellent scenario for using AJAX to save a draft of the users’ form data, or at least ping their session to keep it alive. And you would be correct. But there are two reasons I did not take this path in response to the problem: 1) I’m trying to remember to follow the web standards principle that JavaScript should be used only to enhance functionality, but the site should still work even with it turned off (though in practice I often forget to honor this principle), and 2) the site is in its peak of activity this week, and it would be daft to implement a major functionality change in the form right now — not enough time for adequate testing.

So, the task at hand was simply to increase the session timeout period, so users could stay on the form for a longer time without losing their sessions.

Seems easy enough. The CakePHP config.php file has some settings that play directly into this: Session.timeout and Security.level.

Session.timeout is an integer representing the number of seconds in the session. Well, not exactly. It’s a multiplier value, and the actual session timeout duration is determined by multiplying Session.timeout by the value associated with Security.level, which itself has three possible values: high, medium and low, corresponding respectively to ×10, ×100 and ×300.

I already had Security.level set to low and Session.timeout set to 1800, so really, the sessions should have stayed alive for over six days of inactivity. And yet, sessions were timing out after about 20 minutes. What gives?

What gives is another value in the config.php file: Session.save.

CakePHP offers a number of ways to store session data, but the default value is php, which means it uses the built-in session functionality in PHP. The problem is, PHP has its own session timeout setting (in the php.ini file), and frankly my dear, PHP doesn’t give a damn what CakePHP’s session timeout setting is. And so, with Session.save left at its default php value, my sessions were timing out after 20 minutes (the PHP default) no matter what I changed in config.php.

So, an experiment: I decided to change Session.save to cake, which tells it to use CakePHP’s own session cache, located inside your CakePHP application under app/tmp/sessions. (Be sure that path is fully writable by Apache!)

Success! I left a browser window open on my test site overnight, and the session was still active the next morning. But along the way in my troubleshooting, I had changed my Session.timeout value to 14400, which when combined with the Security.level setting of low (that is, when multiplied by 300), had my sessions enduring for a ridiculously long 50 days! Some quick work with a calculator (although, in retrospect, I ought to have been able to divide 14400 by 50 in my head) told me to set Session.timeout to 288 if I wanted my sessions to last for 24 hours.

You can’t specialize in everything

It’s been one of those weeks that a freelancer dreads. Lots of fires to put out. You’re trying to swim upstream (as always) but instead you’re treading water in a rapids. Without a team of coworkers to depend on, when a problem arises, there’s no one to pass the buck to, or at least to, uh, share it with.

The problems haven’t really been that bad. Just a few bugs to squash, a few scripts to optimize, a few clients to reassure. But when you feel like you have to be the expert at whatever you do, this kind of week can be a source of anxiety.

It doesn’t help when your main lifeline to the tech world is the expert blogs you follow. Read a few articles on A List Apart and you’ll feel both inspired and a little despondent. There are so many incredibly talented, creative people out there doing amazing things. So why am I banging my head against the wall trying to figure out why all of my form fields suddenly disappeared in IE6? (Turns out it was the position: relative on the #main element, easily fixed by overriding it with position: static in the IE6-specific CSS file I wish I didn’t have to create.)

The point is, as a freelancer, at least one who aspires to be good, if not great, at what you do, you are your own harshest critic and worst enemy. There’s no way any of my clients would ever beat me up the way I beat up myself. I don’t think I’ve ever even had one detectably angry with me. But I am constantly getting frustrated with myself for not being on top of every single technology I put my hands on, and I’m inclined to treat every bug as a personal failure.

The sad fact is, it’s impossible. You can’t specialize in everything. It’s right there in the word. Specialize. As a freelancer, you have to pick a few things to focus on as your greatest strengths, while becoming as well-rounded as you can. But there’s always someone out there who knows more about CSS3 or HTML5 or PHP or jQuery or Whatchamacallit than you do. The great thing about being a freelancer in the age of the Internet, especially if you work on the Internet, is that a lot of those superstar über-geniuses are willing to share that knowledge with you for free. All you have to do is search for it.

The biggest danger in following the superstars of your chosen field, though, is idol worship. You get to know so many facets of their work and their personalities (especially if you follow them on Twitter), that you may be tempted to think you know them personally. You might even have a brief exchange with them about baseball. But that doesn’t mean you know them or know what their lives are really like.

We all make sacrifices to live the lives we choose. It’s inherent in the finite nature of human existence. Chances are, I’ll never be a web development “rock star,” because I’ve made choices that took me on another path. I wanted to be able to work on my terms, and fit my career in as one aspect of my life. I’m not logging the kind of hours I’d need to in order to get rich doing work for hire, or building the next great social networking site. But I have time to spend with my kids and SLP (though probably still not as much as would be ideal). I can make music. I can try to set the world record on my Asteroids cocktail table. (OK, that’ll never happen, but it’s 2 feet from my desk in my home office, if I ever decide to get serious.) I can take an afternoon off to take my son to see Toy Story 3 or head down to Target Field for a Twins game or write on my coffee blog or get some fish tacos at Sea Salt.

Or, I can spend half the morning beating myself up because I’m not Jeffrey Zeldman. But, who is? (OK, he is. But that’s it.)

The point is, I’m me. I’m damn good at what I do, but I can’t do everything. And that’s OK.

When is a CSV not a CSV? When you’re downloading it in Safari

Here’s another post that’s basically a cry for help. I did find this forum thread on the topic, but not a solution.

The problem: when I download a CSV file in Safari, for some inexplicable reason, Safari appends a .xls (Microsoft Excel) extension to the filename.

Never mind that I don’t use Excel… I use Apple’s own spreadsheet software, Numbers, from the iWork suite. Never mind that I don’t even have Excel installed on my Mac. Why, why on Earth, would Safari append a .xls extension on a CSV file? It’s not an Excel file; it’s a CSV. Different format. Sure, Excel can open it. But, you know what? Numbers doesn’t open it properly when it has that stupid extension on it.

Take the exact same file, remove the .xls extension (leaving the .csv extension), and Numbers opens it just fine. Leave it the way Safari has it, and it’s a mess.

This is not the only annoyance I have with Safari’s handling of downloads. I also hate how it automatically expands “safe” files, placing the original .zip or .dmg file in the Trash. I don’t want to delete those files! But if I turn this option off, it also doesn’t open the files I want it to open automatically, like Amazon MP3 downloads.

But hands down, this CSV bug — yes, that’s right, I called it a bug — is my biggest source of frustration. Sure, it’s easy enough to remove the extension. But it shouldn’t be there in the first place!

Forgot your password? Firefox may be able to help with that

A couple of days ago, I changed my password for the CMS on my website. Unfortunately, Firefox has refused to “remember” the new password, auto-completing the field for me with the old password every time I open it. In the past, when I’ve changed a password, Firefox has offered to remember the new one, but in this instance it did not. (I think I know why, but trying to explain that is outside of the scope of what I care to discuss here today.)

A little query into the Firefox help site provided an answer. Pretty easy, right? But then that got me thinking. Take a look at this screenshot:

You click that “Yes” button, and Firefox is going to display all of your saved passwords in the clear on your computer screen. That’s both incredibly handy, in case you need to remember a password that you’ve forgotten (maybe not even for the site it’s saved with — I’m sure most people reuse the same password[s] most of the time), and incredibly dangerous, in that someone else accessing your computer could open up Firefox and find out all of your passwords.

This leads me to recommend some “best practices” for managing your personal passwords. I follow these rules in order to keep my information (relatively) safe:

1. Don’t use the same password everywhere. It’s unrealistic to think you can remember a different password for every website, but I have a mental store of about 5 or 6 different passwords.

2. Complex passwords are more secure. Your passwords should not contain any dictionary words, and ideally they should contain a mix of upper- and lowercase letters along with numbers and punctuation marks. Also, the longer, the better. It’s really quite amazing how much longer it would take an average modern-day desktop computer to crack an 8-character-long password using this mix of 96 possible characters (23 years), compared to a 6-character-long password using just lowercase letters (30 seconds). Even if you just use lowercase letters, length makes a huge difference: a 20-character, all-lowercase password would take 63 trillion years to crack.

3. Don’t use the same password for your bank that you use for Facebook. This relates to the first item. Reserve your most complex, hardest-to-crack password for the most critical uses: your bank account, PayPal, etc. Generally, anything involving money or the possibility of identity theft (such as a site where you need to provide your Social Security number). Granted, you should probably have a pretty strong password on Facebook, too, but the bottom line is, don’t use your banking password anywhere else.

4. Password-protect your computer, too! This is probably the hardest case for me to make. Especially if you have a desktop computer that just sits in your house all the time, it’s really easy to not bother protecting it. But think about it: if someone breaks into your house, they may be able to steal some of your valuable personal property, but if they’re granted unfettered access to your computer, they could do much more damage than that. In fact, a deft criminal could get in and out without a trace, except that they logged into your computer and stole all of your passwords. If you take your laptop with you to public places where you might leave it unattended at some point, the risk is even greater. And if you’re accessing public networks, physical access to your computer is not even necessary, so a strong password to log into your computer is just as important as the password on your bank account — especially if Firefox has stored an easily-discovered copy of that password on your computer. Which leads to my final recommendation…

5. Resist the temptation to allow your browser to save your most important passwords. I let Firefox “remember” almost all of my passwords. It just makes using the web a lot easier. But I never let it remember my passwords for my bank or PayPal. If you’re only going to file away one convoluted 20-character string in your brain, let it be your bank password. Don’t leave it to Firefox to remember that one for you.

Need more? Symantec has some good recommendations as well.