Sunday, October 25, 2015

Web Security: Cross Site Request Forgery [Freelancer Town Hall]



Must Haves for A Good Presentation

Being able to communicate a valuable subject matter to an audience and cast the vision for maximizing the impact of your presentation is an invaluable skill. Others think that people are speakers just because they were endowed with the personality or talent to be a public speaker. But, NO, you definitely have to practice that and learn the right techniques.

There are many who speaks in public but are lost on organizing their thoughts to communicate their topic. Others were too timid in their childhood but were put in a situation to speak and were able to grow their skill and become really effective.

Public speaking is also a carefully grown craft. Below are some of the must haves that I have put together in my miss and hit experiences in public speaking. I also got some points from those who did effective TEDx and inspirational talks.

THE PRESENTATION CONTENT

Remember that you are doing the talk to affect and drive your audience to a specific action. So, be very clear with yourself on the purpose of your presentation. State your purpose like a central theme. Be concise. Brevity is your friend. How short? Try to think the length of a single twitter post. State your central theme in 140 characters. It should be engaging or challenging. You are going to repeat this throughout your presentation. Repetition is key to retention. Example, from Steve Jobs: MacBook Air - The Thinnest Notebook in the World. One of my own: Don't be fooled, retool!

Next, is the rest of your content. Please observe on giving 3 to 7 parts, power points or major ideas in the whole presentation. They say that people only retain so much information in one seating. There are studies that 7 is the maximum that they can retain in one instance. I even recommend to keep it inside 3 to 5. 7 is a hard limit.

Appeal to the emotion. Thought statistics and numbers are important, but they are boring. Your content should follow a story like narrative. After your intro, develop the part when you meet the mind boggling problem. And then create a series of ideas that crescendo to the solution to the problem like a eureka moment (which should be the climax) and tell them how the solution changes your life (and their lives). And then with this new found realization, how do you see the world now after 5 years or somewhere far off more into the future. And always leave with a positive note or a good challenge.

The content should be free of jargons, deep terms or too technical terms. When you have to explain a highly technical concept for your audience, try to use illustrations. For example, I explained one time about a website, cookie header and session id by comparing them to a building (this is the website), temporary id issued by the building (this is the session id) and the wallet where you keep your temporary id (the cookie header).

Make sure that you focus on your topic. All efforts and content must relate to it.

Saturate the resources in the internet about your subject matter. Most likely, someone will ask you on alternatives, why the approach isn't like this or that, why wasn't it combined to something else, questions that you can probably answer in advance if you saturate resources over the internet.

Present your content to someone you think is knowledgeable with your subject matter. Their input should be invaluable. Do this early so that mistakes on your content can be corrected early.

THE PRESENTOR

Master your content. Practice presenting in front of the mirror, in front of your friends or try taking a video of yourself. See your bad mannerisms and try to remove them. Ask feedback and receive the feedback with humility and objectivity. Practice, revise, practice, revise and practice practice practice until you drop! Practice breeds confidence.

As the presentor, you should look credible. You should wear the proper attire. If it is a professional talk, a top with a collar is still the minimum appropriate wear. In general, you should dress in a way that the audience will identify and respect you. Looking clean is always a requirement. If you are in an outreach, dress down to jeans and tshirt with plain design so that the audience can identify with you.

THE PRESENTATION

You already have great content and you mastered your content and you know you are credible. Next you should master engaging your audience during the presentation. Engaging means, your audience are involved, interested, have a clear grasp of your topic and able to leave your talk with changed perspectives. Below are I think the ingredients and techniques to engage your audience in your presentation.

Nail the first minutes. In the first two minutes of your presentation, the audience must understand why they are listening to you and your subject matter. This can be in a form of a challenge question, a touching story or eye opening statistics or a combination of any of those. You should be able to tell them as well why you are a credible speaker for the topic. Tell them a summary of the whole presentation in 3 parts.

Have clarity. Do not clatter any singular slide with information. Remember, most of the time, your audience will either listen or read your slide, but not both. Each slide should contain one and only one idea. And together they should flow like a story. The slides are not a script, they should not be read. Slides only enhance and help the info you are saying. Emphasize main points with big singular pictures. I recommend google slide templates to give you an idea on how this should be done. Here is the link: http://www.slidescarnival.com/

It's all about your audience. Know your audience. Some are visual learners, auditory learners, and some are experiential learners. Have a mix in your presentation that caters to all these types of learners. Your slides are visual. Your appropriate use of tone (Don't be monotone, be natural) and use of sounds, music perhaps are auditory. When you let them interact, something like, "Tell your seatmates..." is experiential.

Use the art of pause. There are ideas that need time to sink in. (pause) Use the art of pause.

Use humor. We all have different styles of giving sense of humor. So use your own. No need to try hard. Humor enhances the audience and presentor relationship. You gain a little trust when the audience know that you can make them laugh. You can use humor to break the ice of the most serious parts of the talk. Humor can also fill in lull moments or awkward moments like when your clicker suddenly is not working or there were other technical issues in the presentation day.

(To be continued...)

Saturday, October 3, 2015

How Useful is the Java Network Launch Protocol (JNLP)

Sometimes, you download an application and you expect it to run after easy installation (double click?). But then you found out that there are dependencies that you have to download as well and setup. This happens all the time and it's time consuming. It needs a little bit more of will power to get yourself together and see the end of the installation. Right?

Java Network Launch Protocol (JNLP) is the designed way by Sun Microsystems to make it easy for any user to launch java applications without having to think much about dependencies and how to setup the java application. In just one click of a browser link, the java installed by your browser reads what you call a jnlp config file that contains the link to the app artifact, its dependencies, and the app sets up and launches itself. It's really a bright idea solution.

<a href="/path_to_the_jnlp_file/somefile.jnlp">Launch Application</a>

What are the amazing uses of this?

You can now call java applications and launch them from the browser. That's the original idea. JNLP was created to adopt to web technologies. But, you can actually use JNLP from anywhere that you have an installed java and where you can make an http request; for example, on your command line. Java Web Start (JavaWS) library run JNLP.

$ javaws http://www.somesite.com/somefile.jnlp

Other benefits of using JNLP is that out of the box, it can manage the update process of your application. It also manage your taskbar icon launcher.

So now you say, "Wow, letting my friend know about my java app is as easy as sending them a link!" Well, that might be true, but NOT for a lot of scenarios.

When you execute your application through JNLP, your application will be put in a sandboxed state. That means javaws will put your application in an isolated environment and you only have limited control over it. You can only play by the tools in the sandbox state javaws gives you. Your application files are cached. Your application launcher behavior is at the mercy of javaws. Limitations and bugs inherent to the sandboxed state will affect your app and the experience of your users.

Why do they have to put your app in a sandboxed state?

Well, they have to. Remember that your link that launches the app can be opened to any operating system (OS). And different OSes have different ways of administering the folder tree, it's access rights and permission to the file systems which java have no control of. JavaWS has to put your app in an environment that it can control.

Inherent to that sandboxed state are limitations and bugs that until now, weren't resolved by the Sun Microsystems:

1) Your app won't be able to update the Java Runtime Environment (JRE).

That is an obvious consequence. Java in a particular version manages your application. It cannot upgrade itself (cyclic dependency), shutdown and use the new JRE by itself. It needs another "worker" to do that switching.

2) It is not compatible with the Content Delivery Network (CDN) system.

JNLP can update your app when you specify on your jnlp that your app changed version. The update will then reinstall, remove the cached state and re-caches your updated application. But javaws also checks for the location of your resources over the internet. When any of those change, it updates your application.

The problem now is when you have resources put in CDN. CDN loves to randomly give you server locations in a specific geographical area near you. So your resources will have varying ip addresses when requested through javaws and this will trigger its update mechanism EVERY TIME. Every time you open the app, you will always have an overhead of downloading the whole app. It will really be annoying especially if downloading takes 30 seconds! Very unproductive.

3) Your icon launcher will have limited functionality.

The icon launcher is within JavaWS control. So whatever functionality JavaWS hands you over, you have no choice over it.

Sometimes, you want to put right click functionality to your icon. Put tooltip messages. None of those are offered by JavaWS.

4) The sandboxed state is buggy.

JavaWS gives you a control panel or what they call cache viewer to manually remove/restart the caching of your application. There were a lot of times that we removed the application already from the panel but the application seems to be running elsewhere. We cannot start a new state for the app because we have to find the process id and shut down the "lost state" of the app. In short, the caching mechanism cannot be trusted.

The javaws icon launcher as well is buggy. We tested our app in different OS; mac, linux and windows. To all of those, the icon launcher sometimes don't get the app icon we specified in jnlp. Also, the behavior of your icon on the taskbar is unpredictable.

5) Stale caches and other issues.

Just refer to this article and this forum post.

Now, going back to the thesis title of this article, how useful is the java network launch protocol. How useful? It's only for Proof of Concept type of projects; you want to show in a one time fashion that your application works. If you use JNLP beyond that, it's very possible that your user will bump into any one of these issues.

For production releases, or for scalability and long term engagement with your users, NEVER use jnlp or javaws.

In my observation as well, these problems are not being resolved actively by oracle.

Sunday, October 5, 2014

Initial Server Setup for Linux Server

This was made on Ubuntu 14.04 LTS.

It's my personal list. I'll probably update this once in a while when I see a good practice for an initial server setup.

Your goals basically are:
1) to add a user and use it instead of the root
2) change the ssh port to add protection on random hackers attacking at the default ssh port

Ssh on the server:
$ ssh root@<server ip address>

Change your password.
$ passwd

Add a user.
$ adduser <sample user: bujo>

Add root priveleges to bujo via "sudo" command.
$ visudo
This opens up a file using the 'nano' editor.
Find the lines with the following notes

#User privilege specification
root ALL=(ALL:ALL) ALL

Add in 'bujo'. Copy the line with the 'root' and 'ALL...' value and paste it in the next line and just replace 'root' with 'bujo' on the copied line.

bujo ALL=(ALL:ALL) ALL

Save.

Next, configure your ssh.
$ vim /etc/ssh/sshd_config

Change ssh port.
Look at the line with:
Port 22

Just change 22 with any number between 1025 to 65536.

Next you can disable root login. Just change the value of the
PermitRootLogin yes
to 'no'.

But I don't recommend that. If you have a difficult password for the root user and it is securely stored, like using a key manager, for example keepassx, you can leave your server able to login root. That admin power may one day be needed and you might need it fast.

Now it's time to permit the user/s you defined. Add in to your ssh_config
AllowUsers bujo root

AllowUsers is a directive. 'bujo' and 'root' are the allowed users to login in your system.
Save.

Restart your ssh.
$ service ssh restart

You're done with the configs. Next TEST the config. :)
Remember, DO NOT EXIT FROM YOUR CURRENT TERMINAL SESSION.
Sometimes, you do mistakes in your config changes and you make your server out of reach to anyone even to yourself. For example, you have put "PermitRootLogin no" and added "AllowUsers" with no value after it, or misspelled your new user name. With this mistakes, you can only correct them with the current session you have in your server. So you don't log out of that current session until you finished testing your changes from another terminal.

Open a new terminal. Try logging in using your old 'root'. Remember, your ssh is now assigned to a new port in your server. So logging in will have to consider that.
$ ssh -p <new port assignment> root@<server ip>
Then exit and try to login again using 'bujo'. When there seems to be a problem, you can check and change the config, and restart sshd_config by the original terminal session you still have.

And when you are done logging in, you have now a solid setup to install your applications in your server. You can now leave the 'root' user behind and use it only when you need speed (not needing to do 'sudo') on very important server setups that is safe and you are comfortable doing.

Thursday, September 18, 2014

Palindrome Algorithm

This is my personal attempt to identify if a word (or series of words) is a palindrome.
Written in java, it's an optimal solution.

public class PalindromeTest {

    public static void main(String[] args) {

        for (String input : args) {

            if (isValid(input)) {
                int mid = input.length()/2;
                String firstHalf = input.substring(0, mid);
                String secondHalf = input.substring(getProperSecondHalfMid(input.length()), input.length());

                System.out.println(input + " is a palindrome: " + areStringsEqual(firstHalf, getReverseString(secondHalf)));
            } else {
                System.out.println("Sorry, input: " + input + ", is not valid!");
            }

        }

    }

    private static int getProperSecondHalfMid(int length) {
        return length%2 == 0 ? length/2: length/2 + 1;
    }

    private static String getReverseString(String secondHalf) {
        return (new StringBuffer(secondHalf).reverse().toString());
    }

    private static String areStringsEqual(String firstHalf, String secondHalf) {
        return Boolean.toString(firstHalf.equalsIgnoreCase(secondHalf));
    }

    private static boolean isValid(String input) {
        return !input.isEmpty();
    }

}



Friday, September 12, 2014

Sample Template on Starting a Single Java Project Using Gradle

Skip to the steps

You always want to program or create your own implementation of anything in your mind or anything out there.
So you always do a simple project.
This article reveals my template on how I always start my simple projects.

For some, creating one file and running it is enough for just experimenting a functionality, like
$ python Starter.py
$ php Starter.php
$ java Starter

That's it, one class and their done.

But for me, I like to keep my projects on industry standard even if they are just small or simple. I create a template structure before I start my implementation classes. Well you just don't know when you want to scale up any of your projects. Plus, you know how it is today with companies they throw words around like clean code, coverage, automation and cloud repos (like github). With these you must have by default structure, unit tests, source control manager (scm) and a build tool in your project. Java language has always been my strongest suit, so i'll create this starter demo project using Java. Also, gradle for my build tool and git for my scm.

Just before we start, I just want to address why I chose gradle and git.

For build tool, maven and gradle are, hands down, the most recommended. But after seeing their dependency declarations

Maven
---------













Gradle
--------




It's kinda obvious now right? Readability and maintainability, gradle it is. I never went back to Maven.

For SCM. Distributed repository is the way to go. Keeping them locally in your computer gives you a lot more power and more efficiency in execution of usual tasks like branching and managing your commits and merges. I never wanted to go back to CVS or SVN. I got caught up with the git bandwagon so it's what I stuck into as the scm for distributed repository. There is also that github mania. Maybe later on I will try others like Mercurial.

Creating a project from an advance IDE like Eclipse, Netbeans or Intellij is fine, but don't you want to know how it is done under the hood? Also, do you notice there are a lot of files added to your project upon creation? You can keep those auto generated files to a minimum by creating your project manually from scratch.

Okay... let's start.
Should just take about 10 mins for Mac or Linux, without the downloads.
I made this through Mac, but the principle should be similar to any Linux and Windows OS.

1) If you don't have them yet, install your tools: java, gradle, git
- for java, use JEM, the Java Environment Manager to install and manage your java versions: https://www.npmjs.org/package/jem
For windows, just download and install a version you like.
- for gradle, I used a package manager called homebrew
$ brew install gradle
- for git
$ brew install git

2) Create a standard folder structure.

$ mkdir gradle-starter-project
$ cd gradle-starter-project
$ mkdir -p src/main/java
$ mkdir -p src/test/java
$ mkdir -p src/main/resources
$ mkdir -p src/test/resources

3) Create 'build.gradle' file in your root project directory, it's your simplified pom.xml.
$ touch build.gradle

4) Add the java plugin on build.gradle
$ vim build.gradle
apply plugin: 'java'

Then save your file.
:wq

(This plugin is all you need to clean, execute your test classes, compile, download dependencies and bundle your project into a jar file with one simple command:
'$ gradle build')

5) Lastly, activate source control management for your project.
$ git init

This transforms your project directory into a git repository.

And voila, you're done!
This is how I start whatever single project I have, even the simple ones.

This is how your project folder structure should end up:













There, the template where I start my simple java projects.

Tuesday, August 20, 2013

Touch Typing

This article are for those who are working most of the time in front of their computers and don't touch type. This is my personal experience and I wanted to give you a reason that the time to learn touch typing is now. :)

Just to make it clear, you don't have to be a touch typist to be a great developer, writer or encoder. BUT... if you are already good at what you do in front of the computer, touch typing will still make you produce that same good work but with lesser effort and can make you even more efficient and effective by channelling those new found excess effort to adding quality to your work or by being more productive... overall making you a lot comfortably and noticeably better at what you do. Sounds cool enough?

3 months ago, I type 35 to 40 words per minute. I'm already 7 years in the IT industry and my way of doing things work for all those years, so why put an effort to touch type, right? Besides, it's difficult not looking at the keyboard. Well, that's what I thought.

About 3 months ago, I got to this new company that uses these mechanical keyboards with no characters on the keys. YES, NO characters! So, even if I look at the keys, it will not help. So I have no choice, I have to learn to touch type. I was forced into this. {-_-}

I practiced close to 30 minutes a day. From 35 to 40 words per minute (wpm), that week I went falling down to 20 to 25 wpm. That made me really frustrated, and I felt unproductive. But after a week it got better, I went back to 30 wpm. After the second week, I'm typing back to 35 to 40 wpm. To my surprise, after a month I'm nearly 50 wpm. And after 3 months, I'm typing 60-65 wpm. And the other day I just made it to 75 wpm.



But I know, this is not even the limit. My sister, types at 100 wpm. 


Okay, yeah... you might actually figure out, it's actually addicting to improve this skill. One thing this experience has taught me, it is possible to learn something completely different. I just have to be open about it OR, be forced into it. :D
But more than just addicting, I'm motivated to improving more my skills in touch typing because of the tremendous benefits I have experienced.

You see, when you work in front of the computer, what you do is type. Many don't notice, but a lot of effort is spent on typing if you work in front of your computer. Have you ever experienced these:
1. You have a lot in your head and you started typing them on your computer. You were typing slowly the thoughts in your head but after finishing one thought, you forgot the next one.
2. You do write your thoughts first on paper because your faster writing things on paper, then you type the same things on your computer afterwards. You feel it's a monotonous work.
3. You hit backspace a lot. Maybe 10% to 30% of the time.
4. You felt tired after encoding a few pages of hard copy files. You've done nothing else to make you feel tired, just copy the pages of the files. Maybe all in all, 4 pages.

Now, I tell you, these are some of my experiences typing at 35 to 40 words per minute. All of them are being addressed now by touch typing. :)
You know how touch typing addresses all these? Touch typing removes the effort of consciously doing the mechanical part of your typing. Now, don't underestimate the tremendous benefit of that in your focus, productivity, time, creativity and health. If work is a big part of your life, this skill is a big upgrade for you I tell you. For writers, it's a game changer if they have to write 5,000 words a day for their articles. For programmers, it keeps their flow of thought logic in the head intact and easily translatable into codes. For encoders, this would mean 50% to 100% more spreadsheets of reports done in a day.

Here are a few more articles to establish more my realizations.

So, when should you learn touch typing?
I thought I never needed it until I was forced to doing it.
Now, I'm reaping the rewards of having this skill.

The answer is NOW. I totally recommend it and assure you that you will reap its invaluable benefits. :)

It might be funny for others who are already touch typing a lot longer than I did to read this. I'm already 30. But that is exactly another reason to tell you to do it NOW. :)
Although it might have been late for me, the important thing is once you saw something good, you don't let it pass and you grab the opportunity and make value out of it.

Here is a good site to kick start your practice. Enjoy!