This week I’ve been working on the Mr Whitty Sings Christmas site. You can go to the site, watch the live video stream of Mr Whitty and even request a Christmas song for him to play. It’s gone down pretty well so far. Possibly the funniest moment was a re-enactment of Jesus’ birth. Jesus was a doll of one of the Little Britain characters and Joseph was in an Elvis costume.

Happy Christmas
Mr Whitty, the human Christmas jukebox

This is a trick vulnerability I learnt about from a talk I went to by Rasmus Lerdorf called ‘Exploring The Broken Web’. He took delegates on a 30 minute whirlwind tour of security vulnurabilities on the internet, specifically what can be done with XSS combined with a bit of social engineering.

He only briefly skimmed on an area that interested me. He exposed how a developer can check a user’s browser history, by just asking for it.

The trick is to use a small (and very simple) JavaScript code along with some CSS to find out which websites a user has visited from a list you provide.

Rasmus mentioned the script as something of use to phishers (they can find out which banks you bank online with and send you the appropriate phishing emails). I saw a less immoral use for it (although I won’t deny it’s still immoral): purely for marketing statistics. If I had a site selling t-shirts, like www.bensfunkytshirts.com I could use this script to find out if my visitors had also been to threadless, bustedtees and designbyhumans – or any other site.

Here’s the CSS:

#links a {width: 0px; overflow: hidden;}
#links div {margin: 0; padding: 0;}
a {position: absolute;}
a:visited {left: 1px;}

Here’s the JavaScript:

onload =function() {
var links =document.getElementsByTagName('a');
var visited =new Array();
for(i =0; i<links.length; i++) {
if(links[i].offsetLeft==1) visited.push(links[i].id);
}

//reveal on page the results
for(i =0; i<visited.length; i++) document.write('You have been to ' + visited[i] + '<br />');
}
</script>

Finally, here’s the HTML:

<div id="links">
<div><a id="Yahoo" href="http://www.yahoo.com/">.</a></div>
<div><a id="Google" href="http://www.google.com/">.</a></div>
<div><a id="BBC-News" href="http://news.bbc.co.uk/">.</a></div>
<div><a id="SlashDot" href="http://slashdot.org/">.</a></div>
</div>

I’ve put an example of the script working up here:
http://www.hostengage.com.au/dev/historyInquisition/

If I were to use a simple piece of Ajax, or to stick the sites I know you’ve visited into a simple hidden form, I could easily learn far more about your browsing habits than you would want me to know.

Update (2008-06-12)
I’ve finally got round to putting together an example of this working.

waterfall-abseiling

Originally uploaded by The Feds

We went canyoning in the Blue Mountains last weekend. It was amazing. We put on 5mm wetsuits (thick) and followed a stream down through a canyon: jumping into rockpools backwards, sliding down rocks and finally we abseiled down a 50 foot waterfall.

We did it with High n Wild in Katoomba. They really knew their stuff. We did an abseiling day with them in the winter, so after two trips with them we’d definitely recommend them.

The other week I met up with my old Technical Director whilst I was in London and spent a short while reflecting on how hard it seems to be to find developers, and then further to that how hard it is to find developers suited to agency work.

Now I’m in an agency where I’m the only Web Developer, I’m on the interview panel when it comes to finding other developers. This process has meant I’ve realised how hard it is to find people suitable for the job. There seems to be a mix of designers wanting to try their hand at developing and semi-skilled developers trying to go for a senior position before their time. The creative industry doesn’t seem to attract the talented developers it requires.

I’ve met a few other developers who are skilled but wouldn’t like working in a creative agency. They’re application developers, not web developers. When I asked, they said they actually make an effort to stay clear of jobs like mine. I was not going to be able to convince them to send me their CV. Finding Web Developers for our agency isn’t going to be so easy.

There are characteristics I think developers in creative agencies need to be born with or quickly acquire in order to survive:

1. Social skills. Geeks notoriously don’t have the best people skills, and when it comes to working in a creative agency where sitting in the corner keeping to yourself isn’t going to work, you’re going to have to face up to the fact there’s no getting out of going to lunch with the chatty project manager who thinks as a web developer you should be able to fix his X-Box. I’ve also had to feign an interest in sports a number of times, just to keep up.
2. Ability to work with computer illiterates. Being able to resist self-harm when I’m politely asked to download files and burn them onto a DVD as that is, apparently, what I do for a living. Oh, and I can also offer lots of advice about PowerPoint transitions.
3. Put a project down, picking it up again; repeat. This is more about developing in a way that allows the project to be continued after being put on hold for x amount of time. For example, I’d stop working on Project A because a more urgent Project B needs kicking off, then a number of weeks later I’d be asked to carry on with Project A from where I left off for a couple of days until Project C gets signed off. And no, I can’t get more time for Project A as it’s already over-budget and we don’t want the client back in for another meeting about timings as he eats all the best cookies and hits on the receptionist.
4. Explain yourself in small short words. Bearing in mind that some people in the office still think that a hyperlink is a new type of Japanese train, they’re not going to understand DNS propegation is the reason we can’t launch the website right now, after lunch on a Friday afternoon. Explaining technical concepts to non-technical people take a long patience and short words.
5. Fight for testing. Or test post-launch. Testing is something expected by everyone to be in the project plan, it even makes it into the Gantt charts the producer writes up, but it will be the first thing to go if the deadline looms a little too close for comfort. Or there may be a testing phase, but this is soon followed by changes to the creative that nullifies all testing done so far. Or there will be a testing phase, but only after the site has launched. I can’t point the finger of blame at anyone in particular, as it’s the way things work when you’ve got a small project with a tough deadline. The client asks for changes but the deadline won’t move. Proper testing seems to be a luxury reserved for those clients lacking extensive change requests and a clear understanding of what ’signing off’ really means.
6. See the design as the designer sees it. I’m anal about my work, so quite rightfully the designer will be anal about hers. A bad designer will never say when I’ve messed up a design because she’s scared of me, a good designer will tell me about a mistake I made, a great designer will tell me that I messed up and then tell me why it needs to be fixed. If I can understand the thinking behind the design, I can build it better.

I don’t think that working for a creative agency makes me a better developer, or a worse one. I do think it means I have to approach projects differently. I think working for an agency means you So there are quite specific skills that I think are needed to work in a creative agency as a developer. A lot of these skills are a little different from the stereotypical developer skillset. However, a lot of very talented developers do prefer the creative environment (I just need to find them). I like the small and exciting projects I do in a creative agency. I don’t have the attention span to stay put on one application for months on end. I’d rather download files and burn them obediently to a DVD for the TV producer who doesn’t know what a codec is, whilst performing self-harm here at my desk with a soggy cocktail stick.

I recently interviewed a contract developer for a project we’re short of people on. I was going to be on vacation during the project, so the developer needed to be self-sufficient and able to fully understand the task at hand so I could brief him before I left. I hired a freelancer I thought was best for the job. He wasn’t.

Things I’ll now see as hints I shouldn’t hire a developer:

1. Boasting that he can touch-type as one of the leading items in his skillset
2. Claiming his previous employer ‘didn’t understand him’ and spends 10 minutes ranting about them during the interview
3. He has a law degree and claims that he’ll rip any contract apart
4. He can’t talk plain English to plain English speaking people. Types on an imaginary keyboard as he speaks.
5. He’s 42 and lives in the mountains with his mother. Probably
6. Says something ridiculous and possibly inappropriate in a meeting, then claims it was a ‘brain fart’.
7. Tells my junior behind my back that he’ll learn nothing from me. Tells him that indenting code is a waste of time.
8. Keeps saying ‘crunch crunch crunch’ really loudly when explaining how his code parses data
9. Seems to think a brief is below him, but doesn’t seem to have fully understood it 4 days later
10. Won’t give a time estimate after reading the brief; technical spec; and after several meetings. Has to wait until he’s spent several days working on a script for which you have no use, and then finally saying that he’ll need 8 weeks for a 3 week project without offering any formal breakdown of timings.

This is someone who claims to have 10 years of experience, which is twice what I have. Of course, I’m taking responsibility for hiring the muppet and I thought that with 10 years under his rather long belt he’d find this project easy. Lesson learnt. Next time I’m definitely checking references, asking for sample code and disregarding the claims of grandiose experience and perfect development skills.

If anybody knows of a good PHP developer in Sydney with agency experience please get in touch.

Here’s an idea I’ve had and will never do anything about so I thought I’d put it out there and see what people think.

My problem is that on my Facebook (this idea could apply to other sites but in this post I’m just going to use Facebook) I have lots of people listed as friends. I have a few close friends, then I have friends who I know but who aren’t close – workmates, friends of friends and so on. Then the bulk is made up of the people who I haven’t seen in years, but for some reason are still my friend. The result is too much information for me to manage that isn’t effectively organised. Sure, Facebook lets me define who I want to hear more about and who I want to hear less about, but this is a manual control and I think it should be able to work this out by itself.

How can a system like Facebook work out which is more important to me: wedding photos from someone I went to school with; knowing that my flatmate ‘is bored at work’; or photos of my workmate’s new dog?
Read the rest of this entry »

Why do people I haven’t spoken to in years and haven’t thought about in nearly as long request to be my friend in Facebook? Why do I do the same thing to the other kids who lived in my neighbourhood when I was growing up? For the same reason: to see who’s fat, who’s failed and who still lives at home.

There’s the albino kid who dropped out of school; the sporty kid who was loud; the clever one who was obnoxious; the guy who I thought would never be a civil servant but is. All of the above: their lives aren’t quite as rosy as their school reports may have indicated.

It sounds elitist and terribly mean, but everyone seems to be doing it. Only the other day someone I work with said how she just saw wedding photos on Facebook of a girl she went to school with who punched her in the face once. She got fat and hadn’t aged particularly well, which had an immediate and positive effect on my colleague’s outlook on herself.

I think it’s all about self-assurance. The best way we can see how well we’re doing in life is to compare ourselves to those we started out with. Where are they and where am I?

Of course success is measured by the individual’s perception of what success is. The girl my workmate poked fun at may in turn see my colleague and think how she’s approaching 30, working too hard and still has no ring on her finger, and then there’s no sign of kids for the next few years at least.

The friends in your Facebook aren’t necessarily your friends. They’re individual benchmarks for you to measure yourself up against. Although be warned: the slow kid who wet himself in school assembly that one time who is now a successful entrepreneur with a supermodel wife may find you on Facebook and might just ruin your day.

Possibly the best/worst web innovation I’ve ever experienced is StumbleUpon. Once you start hitting the little green button you can’t stop. You come across a few of those ‘free movie download’ sites that aren’t free and sites by bad designers trying to promote themselves as good designers, but you don’t care. You hit the friendly little button again to feed your hunger for web comics, lists of things you never needed to know and movies of car accidents, pictures of funny looking people and I was just looking at photos of a vampire slaying kit. I don’t need to see that. I don’t need to see any of this stuff, but I’ll click again because hell – my cursor was over in that direction anyway. What does David Lynch say about product placement in a video interview? Do I care? I do but I don’t know why!

It’s an addiction. It has to end.

CTRL + F11 switches off the StumbleUpon toolbar. It was beginning to be a major distraction from work, so making the toolbar disappear has made me more productive (so I can then spend more time writing on my site. Nice one Ben). Now I can switch it on during my lunch break and when I’m on the phone to someone who talks too much. After these I switch it off, and get on with work. Perfect.

Then I press CTRL + F11 again! Damn! It’s the same button to switch it on as it is to switch it off! Who thought of that?! I need a hard way of switching it back on. Something where I have time to stop and think ‘hey, Ben – do you really want to do this? This is the next 30 minutes wasted!’, and then I’d stop switching it on.

Someone needs to write a StumbleAddiction plugin and write it soon. Thousands of Stumblers are at risk. The economy will suffer. The markets will crash. The developed world will fall to it’s knees. Is StumbleUpon doing the work of Al Qaeda?!

It’s a problem. Can somebody fix it?

Sitting in the sushi bar the other night I was furiously trying to use my new phone’s ‘Barcode Scanner’ software to scan the barcode in from a can of beer in front of me. It didn’t work. According to my girlfriend it wasn’t exactly my finest moment, but on the bright side I’ve now found out that the standard barcodes don’t work. The phone reads these different kinds of barcodes that are of a format called Data Matrix 2D. An example of which is on the right (you can scan it in if you’ve got the right software on your phone).

There’s an online tool you can use to make these barcodes here:
http://www.mobiledigit.de/dmcreator/index.html

I’m not sure what use to me this will ever be, but scanning barcodes off the computer screen with my phone fulfills the geek in me that little bit.

Apparently this type of barcode is pretty big in Asia where the kids wear barcodes on their t-shirts. Those crazy guys.

More information on Data Matrix codes here:
http://en.wikipedia.org/wiki/Datamatrix

Sushi in world square, sydney

Originally uploaded by The Feds

The sushi bar Went to the sushi place in world square with laura