I was discussing how quickly Google can pick up some new sites with someone earlier, and I recall it seeing these new blog posts very quickly. This is a test blog post to check. I’ll post the time taken as a comment.

Googlewhack: jeyahnam

There’s been a lot of news today about an “SQL Injection Attack” that’s affected over half a million websites.

Oh no!

First of all, despite comments to the contrary, I’m going to sit here and say: It’s XSS not SQL. The only evidence I’ve seen so far to contradict me is “it was stored in the database”. Well, XSS attacks commonly are. Here’s the difference:

XSS: Uses Javascript either in the site’s page name or a comment/feedback section of a website. The results can either be visible immediately or after the data is re-presented on a page. Badly written sites that allow HTML in comment forms are particularly susceptible to this. This also affected Twitter some months ago.

SQL: Uses SQL in a comment/feedback section of a website. The results are usually visible later when the data is re-presented on a page. Any badly written website is susceptible to this. You’ll notice this a lot if you have an apostrophe in your name and have trouble entering it on a website.

Let me put this simply.

IT IS CALLED SANITISATION.

Sanitisation. Read up about it.

Seriously, how can a collection of developers responsible for over half a million websites be so stupid as to allow this?

So there we have it. I called potentially thousands of programmers stupid. Would any of you like to defend your position, and explain why a tiny bit of sanitisation was so hard for you?

Dumbasses.

I remember when I was in college. We were all using Netscape Navigator. It was around the time Microsoft realised “Whoops, we screwed up, the internet is a big deal after all” and turned around their huge behemoth to focus on Internet Explorer 3/4. There was a great divide in the friendships then: Some loved IE4, some loved Netscape 4. Simon, I’m looking at you…

These were the days when you expected to hack your sites and put separate font tags in every table cell.

The internet has matured. Netscape Navigator died and resurrected as Firefox. Opera eventually realised they can’t charge 1% of the population for a browser and remain relevant, so went free (and ironically still only serve about 1%…).

Eventually the internet matured to such a degree that HTML5 was started, with the excitement and promise of non-Flash video, vector graphics, better input types. Javascript became more than “Oh look, another Javascript error”. The world rejoiced and embraced the new technologies.

Unless the user was running Internet Explorer.

Microsoft themselves have admitted that IE6 has become a big embarressment, a thorn in the side that everyone wants rid of. Frankly, they should have included IE7, and to a lesser degree IE8 in that too. Finally though, Microsoft have released their first ever competent and capable browser! Lets not give too much credit here though, they’ve only done it because they were losing market share rapidly.

Regardless of reasons or history, we’ve just entered an era of co-operability and compliance. Now, more than ever is the time to upgrade.

If you’re using Windows, regardless of which browser you currently use (hopefully Firefox, Chrome or Opera), upgrade your Internet Explorer to v9. If you’re using Windows in your office, push, demand and scream at your IT department until they upgrade.

http://www.beautyoftheweb.com/

So, I hear Larry Page has taken over management of Google from Eric Schmidt. I can only assume Sergey Brin can see what I see.

In my view, Google is an idealistic company. Page and Brin can see what’s good for humanity, in a vaguely socialist way, and want to push ahead with it. Schmidt has no doubt been the quiet voice in their ear saying “This isn’t a good idea…”.

You only need to look at PR disasters such as Street View and their privacy issues to see, a little more careful consideration isn’t a bad thing where Google is concerned. Let’s get something straight here for you readers thinking “Hey, they stole my Wi-Fi info”: If your network wasn’t encrypted, Google reading your data is the least of your problems.

I have a bad feeling this change in management will cause Google to make more badly informed decisions, and upset the general public even more. I’ve said before I’m a big fan of theirs, and believe in their “Don’t be Evil” policy, but this isn’t a case of “trust is earnt”. A company with the size and power of Google will be perceived to have done evil regardless of their intentions.

I can only pray Mr Page will put much more thought into his new product launches than the company as a whole has done until now. Without such consideration, they’ll end up in the newspapers every other day with some new sensational issue.

I wish you luck Mr Page, but I don’t have confidence.

This post relates to the article found at the BBC website, and doubtlessly thousands of other places.

I openly admit, I fall into the Pro-Google group. I believe Brin & Page do ultimately have our best interests at heart, if they are a little naive sometimes. I use Google for search, I use iGoogle for my homepage and I own a Google Android phone. I use Google for adverts (you know, that thing on the bottom right none of you ever click on). I also appreciate their motto “Don’t be Evil” cannot be an absolute.

The anti-trust investigation focuses on Google’s search results, and alleges that the results are manipulated in Google’s favour. I personally think this is unlikely, as it goes against the core principles of Google and their founders. As a point of interest, I searched Google for the term “search engine”. Here’s the results in order:

1. Dogpile Web Search
2. Wikipedia entry on Search Engines
3. Microsoft Bing Search Engine
4. Altavista UK Search Engine
5. Altavista International Search Engine
6. Google
7. Ask Search Engine
8. Yahoo Search Engine

If anything, these results are biased against Google: They have by far the dominant position in worldwide usage, so should be higher up that list?

I’m going to watch this case with interest, but I strongly suspect the companies complaining will end up looking like sore losers.

Every couple of months, I have a look at StatCounter’s Global Stats page, it’s probably one of the most balanced internet usage statistics services in the world, as their counter widgets are installed on a wide variety of websites. Most statistics services are based on access to specific servers, like the W3C’s one. I have a great deal of respect for the W3C, but I don’t believe statistics based on users visiting a technical web developer site is balanced.

As a web developer, browser and operating system usage trends are of great importance to me, though often depressing. I feel I need to know what browsers are most relevant for me to test sites against (if only more people did this, the internet would be a better place…). This philosophy has brought up a few questions about geography and intended demographics.

If the site is of a technical nature, should I instead focus on statistics from the W3C site? Should this blog be better optimised for those the W3C suggests? If so, perhaps I should consider Linux fonts and some more obscure browsers.

Does a shopping site primarily designed for European delivery really care what browsers the Asian market are using? In Europe, Internet Explorer 6 had 3.32% of the usage share in September 2010, but in Asia it has 16.26%!

The best solution, of course, is to optimise every site for every browser, but there comes a point where hours (or even days) of extra work would be done for a browser no one will ever use. Time is money, and money comes from the clients. I feel it’s my responsibility to advise clients as best I can to save them money. I guess it comes down to percentages. Do I or my clients care about a browser with 5% usage share? How about 3%? 2%? Where is the line drawn?

The situation is even more complex when you consider your clients needs in more detail. I’ve recently completed a website for a client who owns an iPad and an iPhone – these devices occupy a marginal share of browser use, but in this case special care was needed to ensure the site worked flawlessly on both. On a similar note, though most people begrudge fixing websites for Internet Explorer 6 or 7, if the client is a business that still has either of these browsers installed on their workstations, the fixes and optimisations suddenly become a lot more important.

A lot of my musings on this matter are courtesy of Internet Explorer. I desperately want to drop IE6 from my testing cycle, but I can’t. I kept telling myself “if it’s under 5% share, who cares?”, but such a cavalier attitude doesn’t make clients happy.

I think it boils down to: Write it for Firefox, fix it for Internet Explorer 8, test it in Chrome, Safari and Opera… Then apply whatever fixes are necessary for Internet Explorer 6 and 7 in a separate stylesheet. Lately this approach has been working well – sites work in everything, but don’t have (as a previous client once put it) “Razzle Dazzle” for the lower share browsers.

Let me define a few terms in the IT world:

Hackers: Used to be known as the seedy, dodgy guys in films who break PCs. Nowadays hackers are the elite programmers who can turn Lead into Gold and such.

Crackers: Always considered “bad”, and now taken on the original definition of hacker. Crackers break things for their own purposes (spam, taking down servers etc).

I’ve had a run-in with some crackers lately which is starting to annoy me. As a server administrator, I wish I could do more about it. PCs in Saudi Arabia, Korea and China have been doing their best to take over my server through SSH, and in separate attempts, turn my server into a spam “bot”.

The widespread abuse of PCs and servers worldwide is becoming a serious issue. I have enough experience to keep these guys out (though I should have changed my SSH port before today…) and haven’t been seriously affected by it, but what about the other guys?

I’m a strong believer in security above all else, but I’ve been somewhat upset recently by a large company not using basic security consistently in their own card processing example code.

I think the point I’m making is twofold:

1. People need to consider security more carefully. You never know what will happen or when. Change default SSH and Remote Desktop ports. Sanitise all your data. Use passwords that no one could possibly ever guess. Use blacklists and blacklist data providers. Implement brute force limitations.

2. Governments need to consider cracking and PC abuse more seriously. If someone breaks into 1000 houses and steals a little money from each, they’d be in prison. If you steal 1000 bank records and commit minor fraud on each, you stand a fair chance of getting away with it. Hell, if you’re in the right country, no one will care.

The world needs to sit down and enforce specific laws around cracking, proxy servers without sufficient logging and infact any service that doesn’t maintain reasonable IP logging. Server owners worldwide need to be held responsible for continuously allowing (willingly or through negligence) cracking, unlawful or illegal activities on their systems. If you’re not logging it and willing to pass this on to the relevant authorities as required, you should be held partially responsible.

You do something illegal on my server, I’m rollin’ over on ya.

I never thought I’d type this entry.

My previous website portfolio has included code to apply hacks and fixes for IE6, 7 and 8. While I’m on the topic, this is good advice for all you budding (or some experienced) web developers out there. Why do I only apply fixes to 6, 7, and 8? IE5.5 and lower are basically no longer used, and people using it expect almost every site they use to look bad with it. IE9 isn’t released yet, and you simply don’t know how your fixes will look in it. This is the common philosophy: Develop it properly, then hack it for IE. Since every version of IE has substantially different rendering bugs, you can’t realistically apply the same fixes for IE6-8 in IE9 before you’ve tested it. You should always be as specific as possible with your hacks and fixes, to save them having unwanted effects in other browsers.

As I was saying. I installed the Internet Explorer 9 beta today. I loaded my most complex sites (with only IE6-8 hacks). I closed my eyes. I’d have prayed if I wasn’t atheist.

I spent a moment in the darkness of my mind thinking about the beautiful curved edges. The advanced Javascript applied styles. The HTML5 video. So pretty.

I opened my eyes.

I blinked.

At this stage, I’m pretty convinced my eyes are still closed, or my mind has stuck on the beautiful imaginings of the Firefox, Chrome, Safari and Opera view of my portfolio. I called my wife over and asked her: “What do you see?”

Internet Explorer 9 actually displayed the site properly. HTML5 video, inline-block li tags with styled block div child elements, curved borders – the lot.

It actually worked. All of it!

It actually worked.

This brings me to the title of this post. Call to Arms:

Now that Microsoft is showing some care towards standards, we all need to upgrade. Lets stop this trend of IE 6 and 7 (plus 8 to a lesser extent) usage NOW. Petition your IT manager, bully your friends and colleagues. No really, bully them.

If a genie appeared before me now and granted me one wish: It would be to instantly upgrade the whole world to IE9.

Thank you Microsoft. It’s been 18 years coming, but thank you.

A while ago I had an idea. Since that time, it’s been pushed further and further back as more important projects have started. Finally, I realise I’m never going to develop the idea, and it’s time to let go and sell the domains. I’ve created a little sedo account and popped two domains up:

localtakeawaymenu.co.uk
localrestaurantmenu.co.uk

If you’re interested, there should be links to register and buy from the sedo holding page.

It’s so simple. You want to use UL elements for your menus. You want to style them with CSS. You want all the LI items centered.

Until now I’ve been using “float: left;”, which then leaves you to manually center the whole UL with specific margins. I’ve developed a simple CMS system which generates all the menus with LI entries, and this obviously poses a big problem with template design. I’d mostly ignored the issue until my latest client, who wants the CMS and lots of centered menus.

I had a quick look online, and most of the sites out there suggest this feature is some kind of black magic, requiring the sacrifice of some poor capra family mammal. Obviously, any simple solution would require decades of tweaking to work in Internet Explorer 6 (from this point forward to be known as “The I Hate Microsoft Browser”).

Nope. In the inimitable and immortal words of “The Meerkat”: Simples.

Here’s whatcha do:

Step 1: It puts the “text-align: center;” in the UL.

Step 2: It puts the “display: inline;” in the LI.

Step 3: It doesn’t put the float in either.

(Don’t worry, this doesn’t involve Buffalo Bill or ointment)

This appears to even work in IE6. (Yes, I know. Shocking isn’t it?)