90% Crud

Why is Apache sending a "X-Pad" header?

Apache sometimes sends an HTTP header "X-Pad: avoid browser bug" for reasons that aren't entirely clear. There isn't a lot of searchable information about this header, so my coworker Matt dug into the source code and found out what's going on.

The header was added to deal with a bug Netscape versions 2 through 4.0b2. The bug was that Netscape would hang if a linefeed character was sent as the 256 or 257 byte. Apache checks to see if it's about to hit the bug and, if so, sends this header to pad the output.

The fix is from April of 1997. If they had waited a few months to report it, they might have earned $1,000 with Netscape's Bug Bounty.

Hopefully this blog post will make the X-Pad header show up in Google and save future people from wondering what it is.

Real RSS Spam

The spammers keep getting cleverer and cleverer. A blog that will remain nameless let its domain name expire. A black-hat SEO spammer bought up the domain, which is pretty common. What surprised me was what happened next.

The spammer must have realized that there was a blog previously at that URL. So they installed a special version of WordPress for SEO spammers (I won't link it here, get in touch if you're really curious) and even published a feed at the exact same URL as the previous RSS feed. When I opened up Google Reader, the long-dormant RSS feed sprang to life with 10 new posts.

I was excited that the blog was back until I read the first one. Once I realized what was going on, I was impressed by the spammer's ingenuity and pissed off that they've found yet another way to intrude on me. I'm so sick of spammers, I wish I could someone could tell me how to get a green card to somewhere they didn't exist.

DRYer than thou

At work we have a project (launching Monday, w00t!) that has a lot of cool things happening on the browser side. You know kids these days, what with their jQueries and Web 2.0s, they need whiz bang special effects in their websites. In my day, we only had one type of input field in our forms, and we liked it! Don't know how lucky they are… but I digress.

One problem we ran into was that we needed to do the same calculation on the server side and the client side. Let's say for the sake of example that we need to calculate Michigan's 6% sales tax or California's 7.25% sales tax. The real calculation was only slightly more complex. One thing to note is that the calculation would need to be very responsive because it would be running a lot and affecting user input, so speed is a concern.

I came up with two options. The first is to write the same calculation in PHP for the server side and JavaScript for the client side. I didn't love this because it isn't DRY. If we had two calculations in two different files then when someone was updating the code they would likely miss the other one.

The other option I came up with was to put the calculation on the server side only and use AJAX to run it on the client side. This seemed overly complex, which will sound funny when you see what we decided on. We had avoided AJAX on the site because it wasn't really needed; adding it for this seemed like a bad value/complexity trade off. I was also worried that server lag could cause a bad user experience, as I pointed out above the calculation needed to be fast.

So I was talking it over with my coworker Matt and he made a joke and we both laughed it off. Then we thought about it, and realized there there were fewer downsides to his approach than my two, so I started coding.

"Up and running"

Xbox Live has a funny definition of "Up and running." As of 7:00pm on Dec 29, 2007 their status message read:

Status: Up and running

Users may experience issues performing transactions dependent on Windows Live ID availability including but not limited to Xbox 360 and Zune account creation, renewal, recovery, all DMP transactions, and logging into or creating Windows Live ID accounts. Users will experience intermittent issues including but not limited to: Tournaments, Storage Downloads, Gamer Tile, Statistics through Arbitration, Match Making, and Messaging. Additionally, Halo 3 and Call of Duty 4 users may experience issues joining matches or posting statistics. Customer Support may also experience issues referencing customer data. We are aware of the issue and are currently working to resolve it. We apologize for any inconvenience.

My Xbox 360's dashboard isn't coming up and I can't get into Halo 3 matchmaking, so the only entertainment I'm left with is pedantically reviewing Microsoft error messages.

Hopefully this will end Ron Paul Diggspam

Ron Paul doesn't believe in evolution:

I think its a theory, theory of evolution, and I don't accept it.

How will Diggers and Redditers reconcile their love of Ron Paul with their hate for creationists? (via)

Best Xmas Present

Sometimes when you go a long time without blogging you don't want to post because you feel like you need to say something important on your return.

Luckily I have something not only worthy of breaking blog silence, but worth overly large text and even the blink tag:

She said yes! We're getting married! I love you Jenny!

Apple's DRM Announcement

Eliminate DRM!
Originally uploaded by nim.

Apple announced that they'll be offering DRM-free music in the iTunes Music Store! I don't have much to add to the announcement, I'm just ecstatic that Apple is following up on Steve Job's open letter. Beyond just offering DRM-free music, Apple even addressed Cory Doctorow's lock-in argument by offering upgrades to existing downloads.

There were people who thought that the letter was a cynical attempt to avoid EU regulation by playing DRM off as a chain imposed by the record companies. I admit that I was leaning that way, it's not the first time I was wrong about Apple and probably not the last. Like other doubters, I'm glad I was wrong.

I don't really have much to add to the conversation, I'm just excited to download more music from iTunes in May (and this time I plan to keep it).

Detroit Roundup

Houses cheaper than cars in Detroit

"At least 16 Detroit houses up for sale on Sunday sold for $30,000 or less.

A boarded-up bungalow on the city's west side brought $1,300. A four-bedroom house near the original Motown recording studio sold for $7,000."

Even better is the MetaFilter discussion about that link (and others): Will The Last Person To Leave Detroit Please Turn Out The Lights?
 

Congressman: Parts Of Iraq Are As Safe As Detroit

What's great about this is that the analogy is arguing that 80% of Iraq and Detroit are "reasonably under control" which means the guy is using Detroit as a point somewhere on the line between IEDs and Broadway musicals. I think he meant it as a sign of progress in Iraq but the Detroiters aren't too happy with where they are on that line.
 

Man Accused Of Drunken Driving On Golf Cart

The golf cart had a winch and plow secured to the front, bicycle lights used as headlights and brake lights, and plastic curtains that hung on the sides and the front as a windscreen, Local 4 reported.

A butane heater and CD player were turned on inside the golf cart.
…
According to the police report, Vanbuskirk replied to a question about who can legally drive a golf cart on the road, saying, "Gov. Granholm."
 

Top 10 Best / Worst Cities For Software Developer Pay

When you adjust for cost of living expenses, software developers in Detroit (I assume the metro area) make better money than those in Silicon Valley or New York:

Metro	Salary	Cost of Living	Adjusted Salary
New York	$89,370	177	$50,492
San Jose	$99,250	192	$51,693
San Francisco	$92,570	206	$44,937
Detroit	$75,250	95	$79,211

 

detroit

Posted by george at 09:50 AM | Comments (2)

inkling Markets 1 Week Later

The inkling markets I started last week have been making progress. While I can't speak authoritatively about why the participants are investing the way they are, I can always make some wild-assed-guesses.

In the OpenID market, the biggest gainers are Wikipedia and Yahoo!. Wikipedia announced that they're working on OpenID, which sounds like it's a lock. But you'll notice that talk was given at the end of April 2006, and since they haven't done it yet, it's possible that they won't make the August 26th deadline of the market.

Another big winner is Yahoo!. They have been pretty aggressive about opening things up lately, they are offering lots of APIs to web developers and I think the feeling is that OpenID is right up their alley. Note that idproxy.net doesn't count as a "win" for Yahoo! since the market is looking at these web sites consuming OpenID.

One stock that surprised me was that MSN.com has the lowest stock price of the bunch. I realize that Microsoft has cultivated the exact opposite appearance as Yahoo! in that people believe that Microsoft refuses to interoperate with anyone else, which is probably driving the stock price down. It's still surprising to me because Microsoft has announced that they will be supporting OpenID. I wonder if the stock price is so low because of the perception of Microsoft as closed or if people believe that Microsoft will be pushing OpenID as an enterprisey technology but not something for consumers.

The Jabber market has some things that surprised me as well. While Yahoo! is doing well and MSN is not–which I attribute to the same things as their performance in OpenID–Skype is currently the highest price stock. That's surprising to me because Skype has not been very open. Of the 5 IM networks in the market, only Skype doesn't work with Adium. In August 2005 Skype announced SkypeNet API which sounds like it might allow Jabber interoperability, but apparently it's been abandoned. I wonder if the SkypeNet API is driving up the stock price or if it's just wishful thinking.

My final observation is that AIM and ICQ (both of which are owned by AOL and interoperable) haven't moved very much at all. This is notable because AOL and Google Talk (which runs on Jabber) announced interoperability in December 2005 but nothing has come from it yet. Since Google Talk runs on Jabber the path of least resistance for interoperability would be for AOL to support it as well, even if they only federate with Google at the start.

SXSW Interactive 2007

I'm registered, have my plane tickets, and my conference schedule picked out. I'm going to SXSW Interactive!

I've wanted to go for years, but it was only recently that the planets aligned and it became feasible for me to make it to Austin. The first order of business is to let everyone know so that I can finally meet a bunch of the people I only know online.

I've also never been to a conference of this sort (I went to some Def Cons in the late 90's, but I imagine this is a bit different) so I'm looking for advice. I have a couple friends who have offered me a floor to sleep on, so the fact that there are 0 hotel rooms available isn't that disconcerting (although additional offers would be gladly welcomed so I don't overstay my welcome). What panels should I make sure to attend? What should a first timer know?