Adventures in IT

Image: Pixabay SOLID is a mnemonic acronym for five object-oriented design principals that are intended to make software designs more understandable (see Wikipedia ). They were promoted by a chap called Robert C Martin who has been programming since before I was born and is an authority on writing clean code.  Laravel is a PHP framework that implements the model-view-controller (MVC) pattern. A lot of people think that their responsibility for OOP design ends with adopting a framework, but actually Laravel is relatively un-opinionated on your OOP design and you still need to think about writing code that is testable and maintainable.  The reason that SOLID principals matter becomes apparent when you work on a single project for a long time. If you're writing throwaway applications for clients that you never expect to work on again (presumably because the client won't hire you again) then the quality of your code doesn't matter. But if you're the guy stuck ...

Image: Pixabay CSRF attacks exploit the trust that a website has in a client like a web browser.  These attacks rely on the website trusting that a request from a client is actually the intention of the person using that client. An attacker will try to trick the web browser into issuing a request to the server.  The server will assume that the request is valid because it trusts the client. At its most simple a CSRF attack could involve making a malicious form on a webpage that causes the client to send a POST request to a url. As an example, imagine that a user called Alice is logged into Facebook in one tab and is browsing the internet on another tab.  A filthy pirate Bob creates a malicious form in a webpage that submits a POST request to Facebook that sends a person to a link of Rick Astley dancing.  Alice arrives on the page we made and Javascript submits the form to Facebook.  Facebook trusts Alice's web browser and there is a valid session for he...

http://jenkins-ci.org/ Jenkins is a free and open source solution for monitoring the execution of jobs, including software project builds. By monitoring the outcome of a build you are able to provide continuous quality control throughout the development period of a project.  The aim is to reduce the effort required in quality control at the end of development by  consistently applying small amounts of effort to quality throughout the development cycle. Under the continuous integration (CI) model developers should consistently integrate their development efforts into the repository.  There should be time delay between committing code changes and the new build - this allows developers to recognize and correct potential problems immediately.  Of course measures must be in place to flag errors with the build. The advantage to developers and project managers to having a stable repository to which commits are made and tested are multiple.  I don't need to ...

Dreams of Technology foiled by pokey companies I've previously found that the Uniforum email form does not allow for providing more than a certain, fixed, number of nameservers.  Apparently nobody would ever require more than that number.  Well unless they're using a high availability DNS service (like www.dnsmadeeasy.com) that is.  If you happen to be using more nameservers than Uniforum has determined to be the maximum that South Africans need then they won't register your domain. More recently I've found that they don't like nameservers where the FQDN lookup doesn't match the reverse lookup.  This is pretty much understandable, but what I don't understand is why it was working for a particular host I use until a month ago and is now no longer working. I raised a support ticket with Uniforum and it took them a good couple of days to come back to me.  I wonder how a company that charges R 50 for every single co.za domain offers such poor service and ...

CSS Data URI's are a way to encode images directly into CSS.  This helps to reduce the number of HTTP requests on your server.  For example:  Instead of linking to an external resource like a background image, your CSS can have the image available within it.  As soon as the CSS is loaded the browser is ready to render the image. This can have real speed advantages, especially if the browser is configured to limit the number of connections to a host.  By freeing up a connection you can improve your rendering time. Another advantage is that if you are serving across a secure connection then all of your page elements can originate from the same, secure site, and not generate those annoying warnings to your visitors that some elements are not secure. More information on CSS data URI is available at http://en.wikipedia.org/wiki/Data_URI_scheme Spritebaker ( http://http://www.spritebaker.com/ ) offers a free web-service.  They will take your CSS and parse...

The supposedly standard method of retrieving a handset's capability is through UAPROF (see UAPROF on Wikipedia). Very simply put a mobile phone should send through identifying information when it retrieves a website. However, UAPROF is entirely voluntary and there are several problems associated with relying on it. Along comes WURFL , which touts itself as a free option to consider when looking to identify the capabilities of your visitors browsers. There are of course paid options to help you identify mobile phones visiting your site (such as device atlas ), but why pay for a service when you can get it free? At first glance WURFL looked very promising. It has an active project on Sourceforge and a set of API's for PHP, JAVA, and others. One immediate problem I encountered was that the current release revision (1.1.r2) of the WURFL API is buggy. Well that's not fair for me to say actually- the API works perfectly, it's just the example code that doesn't work ...

XSS (Cross Site Scripting) is a surprisingly easy weakness to exploit on unprepared websites. To describe it at its highest level an XSS attack involves injecting code into a webpage and having a user execute it on the grounds that they trust the website you have hijacked. There are a great many vectors for an XSS attack to come through, but for the most part applying a few simple safety precautions will greatly improve your site security. XSS attacks can be split into one of three categories: Stored XSS attacks - are those where the attacker stores malicious code in your database, forum, comment section or elsewhere on your site. The victim receives the code when they request that particular content from your website. Reflected XSS attacks - are those where the malicious code is reflected off the server and sent to the victim as part of search results, emails, error messages, etc. This can be set up by tricking the victim into clicking a specially crafted link (or filli...