Coding Horror: Adventures in Rechargeable Batteries (3)
share
digg
on
Coding Horror (463)
5 days, 22 hours
ago
permalink
Every self-respecting geek loves gadgets. I'm no exception. And so many of my favorite gadgets have a voracious appetite for batteries. I don't know why all the other battery types fell so far out of favor, but between AA and AAA, I could probably power 95% of my household gadget needs. I've been a rechargeable battery user for years. It seems the frugal thing to do in the long run, and it's also healthier for ...
Coding Horror: Get Your Database Under Version Control (4)
share
digg
on
Coding Horror (463)
1 week, 3 days
ago
permalink
A little over a year ago, I wrote about the importance of version control for databases. When I ask development teams whether their database is under version control, I usually get blank stares. The database is a critical part of your application. If you deploy version 2.0 of your application against version 1.0 of your database, what do you get? A broken application, that's what. That's why your database should always be under source control, ...
Coding Horror: Can Your Team Pass The Elevator Test? (2)
share
digg
on
Coding Horror (463)
1 week, 4 days
ago
permalink
Software developers do love to code. But very few of them, in my experience, can explain why they're coding. Try this exercise on one of your teammates if you don't believe me. Ask them what they're doing. Then ask them why they're doing it, and keep asking until you get to a reason your customers would understand. What are you working on? I'm fixing the sort order on this datagrid. Why are you working on ...
Coding Horror: Actual Performance, Perceived Performance (5)
share
digg
on
Coding Horror (463)
1 week, 5 days
ago
permalink
If you've used Windows Vista, you've probably noticed that Vista's file copy performance is noticeably worse than Windows XP. I know it's one of the first things I noticed. Here's the irony-- Vista's file copy is based on an improved algorithm and actually performs better in most cases than XP. So how come it seems so darn slow? Let's start with Mark Russinovich's typically excellent and exhaustively in-depth analysis of Vista's file copy algorithm: Perhaps ...
Cross-Site Request Forgeries and You (48)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
2 weeks, 4 days
ago
permalink
As the web becomes more and more pervasive, so do web-based security vulnerabilities. I talked a little bit about the most common web vulnerability, cross-site scripting, in Protecting Your Cookies: HttpOnly. Although XSS is incredibly dangerous, it's a fairly straightforward exploit to understand. Do not allow users to insert arbitrary HTML on your site. The name of the XSS game is sanitizing user input. If you stick to a whitelist based approach -- only allow ...
-
lishevita said:
For the record, Drupal 6.4 is protected against XSRF. :)
-
Brandon Bloom said:
I have a Django middleware installed that does #2
Bill Gates and Code Complete (6)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
3 weeks, 2 days
ago
permalink
By now I'm sure you've at least heard of, if not already seen, the new Windows Vista advertisements featuring Bill Gates and Jerry Seinfeld. They haven't been well received, to put it mildly, but the latest commercial is actually not bad in its longer 4 minute version: On the whole, I'd call these ads opaque bordering on inane. Rumor has it the entire thing has been cancelled. It wasn't entirely unsuccessful, I suppose; the goal ...
-
John said:
Ha ha! I thought that technical bed-time story sounded fairly coherent. It's funny: it seems fairly obvious that the "platform wars" are drawing to a close. I remember when the OS was a big deal, but it does require some effort. Nothing brings the current situation into focus quicker than my being happy with a new computer as soon as I have Internet access: yes, I'll want that DVD with the backup of my e-mail, my instant messaging software configuration, my password database, etc. at some point, but the fact is that most of my e-mail and writing, and the stuff I read (RSS feeds), is all stored on the Web somewhere. And it all happened so seamlessly. I mean, I like Linux, and Ubuntu specifically too, but I'd be happy with anything I could use to access the Internet and play my music (that's the other big one, I guess), so long as it was free; the latter's my primary requirement, and my favourite thing about Linux.
Stack Overflow: None of Us is as Dumb as All of Us (24)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
3 weeks, 4 days
ago
permalink
I'm in no way trying to conflate this with the meaning of my last blog post, but after a six month gestation, we just gave birth to a public website. Of course, I'm making a sly little joke here about community, but I really believe in this stuff. Stack Overflow is, as much as I could make it, an effort of collective programmer community. Here's the original vision statement for Stack Overflow from back in ...
-
David Arcos said:
Me encanta StackOverflow, ya tengo RSSadas algunas categorías...
Spawning a New Process (11)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
1 month
ago
permalink
I don't usually talk about my personal life here, but I have to make an exception in this case. I debated for days which geeky reference I would use as a synonym for "we're having a baby". The title is the best I could do. I'm truly sorry. As an aside, this is something my wife and I have worked at for a number of years, and was only truly possible through the Miracle of ...
Protecting Your Cookies: HttpOnly (109)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
1 month, 2 weeks
ago
permalink
So I have this friend. I've told him time and time again how dangerous XSS vulnerabilities are, and how XSS is now the most common of all publicly reported security vulnerabilities -- dwarfing old standards like buffer overruns and SQL injection. But will he listen? No. He's hard headed. He had to go and write his own HTML sanitizer. Because, well, how difficult can it be? How dangerous could this silly little toy scripting language ...
-
Mone said:
manca un punto, poter accedere ai cookie tramite javascript può servire a proteggersi da XSRF.HttpOnly cookies impediscono questa difesa ma non impediscono XSS, 'bloccano' (lui stesso parla dei buchi nelle attuali implementazioni) solo l'acceso a un'informazione delle tante disponibili a un javascript iniettato. Un esempio banale, il codice attaccante può sempre simulare una finestra di login falsa all'interno di una pagina valida...
-
jmvidal said:
Good tip.
-
dd said:
When you tag a cookie with the HttpOnly flag, it tells the browser that this particular cookie should only be accessed by the server. Any attempt to access the cookie from client script is strictly forbidden.
Coding Horror: Classic Computer Science Puzzles (5)
share
digg
on
Coding Horror (463)
1 month, 2 weeks
ago
permalink
Software developers do have a proclivity for puzzles. Perhaps that's why books like To Mock a Mockingbird exist. It's a collection of logic puzzles which is considered an introduction to lambda calculus, one of the core concepts of Lisp. Such puzzle questions are de rigueur for many programming interviews, though they're often abused. There is a downside to thinking of programming languages as solutions to arbitrarily difficult abstract mathematical puzzles. That's probably why Lisp has ...
Deadlocked! (42)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
1 month, 2 weeks
ago
permalink
You may have noticed that my posting frequency has declined over the last three weeks. That's because I've been busy building that Stack Overflow thing we talked about. It's going well so far. Joel Spolsky also seems to think it's going well, but he's one of the founders so he's clearly biased. For what it's worth, Robert Scoble was enthused about Stack Overflow, though it did not make him cry. Still, I was humbled by ...
-
Bill said:
Maybe if you get a real dev stack, like Apache/MySQL/Django, you wouldn't have these problems.
-
David said:
Wow. Loads speculation and misinformation over a simple example. By chasing down some of the links, I actually learned a good bit.
Coding Horror: Setting up Subversion on Windows (6)
share
digg
on
Coding Horror (463)
1 month, 3 weeks
ago
permalink
When it comes to readily available, free source control, I don't think you can do better than Subversion at the moment. I'm not necessarily advocating Subversion; there are plenty of other great source control systems out there -- but few can match the ubiquity and relative simplicity of Subversion. Beyond that, source control is source control, as long as you're not using Visual SourceSafe. And did I mention that Subversion is ... free? Allow me ...
Check In Early, Check In Often (82)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
1 month, 3 weeks
ago
permalink
I consider this the golden rule of source control: Check in early, check in often. Developers who work for long periods -- and by long I mean more than a day -- without checking anything into source control are setting themselves up for some serious integration headaches down the line. Damon Poole concurs: Developers often put off checking in. They put it off because they don't want to affect other people too early and they ...
-
Ken said:
Atwood as usual with some excellent advice
-
jonezy said:
good advice for developers here
-
Nigel J said:
amen
-
Vishy007 said:
totally agree!
-
Claude said:
I thought I was crazy committing small chunks of tested work.
-
tOMPSON said:
I wish some of my colleagues would stick to this
-
David said:
That's where branching comes in and exclusive locks go out. Unfortunately for us at DTC, MKS is junk :)
Coding Horror: Your Desktop Is Not a Destination (3)
share
digg
on
Coding Horror (463)
1 month, 3 weeks
ago
permalink
I'm of two minds on the desktop. If you're really using your computer, your desktop should almost never be visible. Your screen should be covered with information, with whatever data you're working on. I can't imagine why you'd willingly stare at a static background image-- or even a background image covered with a sea of icons. Unless you consider your computer a really expensive digital picture frame, I suppose. The desktop background, as I see ...
Software Branching and Parallel Universes (2)
share
digg
on
Coding Horror (463)
1 month, 3 weeks
ago
permalink
Source control is the very bedrock of software development. Without some sort of version control system in place, you can't reasonably call yourself a software engineer. If you're using a source control system of any kind, you're versioning files almost by definition. The concept of versioning is deeply embedded in every source control system. You can't avoid it. But there's another concept, equally fundamental to source control, which is much less frequently used in practice. ...
The Perils of FUI: Fake User Interface (61)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
1 month, 3 weeks
ago
permalink
As a software developer, tell me if you've ever done this: Taken a screenshot of something on the desktop Opened it in a graphics program Gone off to work on something else Upon returning to your computer, attempted to click on the screenshot as if it was an actual program. And let's not forget the common goating technique where you take a screenshot of someone's desktop, make it the desktop background, then proceed to hide ...
-
andrin said:
Things like this will probably become everyday news in the future. Most website owners and even many developers are clueless to this phenomena.
-
jmvidal said:
Clever, and scary.
-
fmavituna said:
http://ferruh.mavituna.com/firefox-master-password-dialog-weakness-oku/
Coding Horror: Everything I Needed to Know About Programming I Learned from BASIC (3)
share
digg
on
Coding Horror (463)
1 month, 3 weeks
ago
permalink
Edsger Dijkstra had this to say about Beginner's All Purpose Symbolic Instruction Code: It is practically impossible to teach good programming style to students that have had prior exposure to BASIC; as potential programmers they are mentally mutilated beyond hope of regeneration. I'm sure he was exaggerating here for effect; as much as I admire his 1972 "The Humble Programmer" paper, it's hard to square that humility with the idea that choosing the wrong programming ...
Please Give Us Your Email Password (14)
share
digg
by
Jeff Atwood (268)
on
Coding Horror (463)
1 month, 3 weeks
ago
permalink
A number of people whose opinions I greatly respect have turned me on to Yelp over the last six months or so. Yelp is a community review site, and a great way to discover cool new places in whatever neighborhood you happen to be in. I've enjoyed using Yelp, and I wanted to participate by submitting my first review, so I created a new account there. As part of the account creation process, I was ...
