Category: Geek

Posted on

Allowing Secure User Input with Django

Building a site that needs to accept formatted user input? There’s no way you’re going to let random users input any old HTML – you’d open the door to all kinds of cross-site-scripting attacks and other nastiness. Nor can you just filter out the tags you consider dangerous – that road is fraught with peril. The only solution is to white-list a small subset of tags and unceremoniously drop the rest.

There are two layers to the problem – how to support formatted text on the front-end, and how to process submitted text on the back-end.

For the front-end, some developers are drawn to the Markdown syntax – a supposedly user-friendly wiki-like syntax that can be re-rendered as safe HTML. But while Markdown may look friendly to developers, it doesn’t to normal users – trust me on this. Even for tech-savvy users, Markdown requires that you place syntax instructions on your site (inelegant). A better solution is to use a rich text editor for the web, like TinyMCE or WYMEditor.

Ever notice that you often see rich text editors in content management systems run by trusted users, but seldom on public-facing web pages? That’s because it’s tricky to do securely, and without giving users enough rope to hang themselves formatting-wise.

With a bit of configuration though, you can deploy public-facing rich textareas securely, allowing only the input of tags you specify. But you can’t stop there – all the user has to do is disable Javascript in the browser to bypass your rich text editor. You must process submitted text on the back-end with the same set of rules in your view logic.

Continue reading “Allowing Secure User Input with Django”

Posted on

Blocked from App Store? (What’s In a Name)

Yesterday I got to spend some quality time with an Apple iPad, and quickly discovered that I could not log into the App Store to purchase software. The message I got was “This Apple ID has been disabled for security reasons.” But I purchase content through iTunes regularly on the desktop and iPhone. What’s up? Googling for the error message revealed mixed results. Apple’s official knowledge base article suggested that this can happen if you enter the wrong password too many times. I knew that wasn’t the problem. Then I discovered an article at Redmond Pie talking about how people were being banned from access to the App Store when their usernames included certain “suspicious-looking” strings. My real last name is “Hacker” and I’ve occasionally had trouble signing up for certain services because of it (my poor Dad can’t get a Facebook account to this day – they just ignore his signup attempts). I put two and two together and concluded that I was being banned on account of my name.

Spent half an hour on the phone with Apple, getting bounced from rep to rep, trying to get to the bottom of it. They re-set my account, but the problem remained. Then I realized what I had been doing wrong. Back in the day, Apple services took single-word usernames, like “shacker,” which I had long used to log into the Apple developer center, support forums, and other services. At a certain point, Apple converted these IDs to require a login in the form of an email address. I had simply forgotten this and was trying to use my old Apple ID rather than the email address associated with my Apple account.

The fact that Apple threw this confusing dialog, combined with the blog post I had found referencing hackers being locked out, combined with my previous experience being unable to sign up for certain services, all conspired to make me think I was being blocked because of my name. The truth turned out to be much simpler.

All is well.

Posted on

Stuck Between Stations Redux

The little music writing project I run with some friends, Stuck Between Stations, is now officially three years old. Until yesterday, we were still running with the original design, left over from a time when narrow content columns were in vogue (usability studies still say 420px is the ideal content column width for maximum readability). Trouble is, we run a lot of embedded video on the site, and YouTube/Vimeo have increasingly been defaulting to much wider video dimensions since more and more people have high-resolution displays. Web developers started assuming a baseline pixel resolution of 1024 a few years ago.

But simply widening the old design wasn’t really an option, since it all hung off a photographic banner image that came with a WordPress theme, and so couldn’t be altered. Decided to chuck it all and start from scratch. Chose the Titan theme as a starting point and went from there. Dug up shots of old radio dials from Google Images and pulled a new banner together, keeping only the broadcast tower from the original design.

Was able to run a series of search/replace operations in the database to increase the size of all the embedded videos already on the site. Interesting to see how many different aspect ratios we had accrued without even trying. Also interesting to see how many of the videos had been “Removed due to violation of terms of service.” Seems like the big publishers have been digging deep in YouTube’s bowels to find and skewer copyright violations, even if they do provide free publicity.

Added a bunch of new features while I was working:

Pretty happy with the results, though the banner still feels a bit crude to me. We’re no Flavorwire, but without a few dozen more unpaid writers and some Sand Hill investment, this is about as good as it gets for a while. Would love a plug if you’ve got one to give!


Posted on

Jaron Larnier Presentation

Loose notes from the SXSW 2010 session Untitled by Jaron Larnier.

Wasn’t sure what to expect from this session, which had no title and no description. But a few weeks ago, the photo professor at the J-School handed me a copy of Larnier’s new book You Are Not a Gadget, a sort of backlash manifesto against the digital age. Well, that’s not entirely fair — it’s not so much a backlash as it is a reasoned, thoughtful wander through some of the gotchas and backwaters of the digital age. Larnier talks about dignity, culture, black boxes, the history of our relationship to technology, mean-ness in online communities, and everything in between. His talk was as meandering as the book is, but inspirational and amazing at every turn. Though difficult to encapsulate, Larnier and his thread is something I feel everyone and tech should be listening to.

Continue reading “Jaron Larnier Presentation”

Posted on

RIP Content Management System

Loose notes from SXSW 2010 session RIP Content Management System by Drupal creator Dries Buytaert.

Unfortunately, the “R.I.P. part of the session title was never addressed, nor were any of Drupal’s core shortcomings or architectural annoyances. This was unfortunately just a 30-minute informercial for Drupal.

Would really have preferred to have heard Dries talk about plans to address Drupal’s deep archtitectural problems like lack of object orientation, lack of an ORM, lack of MVC, and annoying templating system. Took notes anyway.
Continue reading “RIP Content Management System”

Posted on

Evan Williams Keynote Interview

Loose notes from SXSW 2010 session: Evan Williams Keynote Interview

Director of the Havas Media Lab Umair Haque interviews Twitter founder Evan Williams (@ev). The interview began with technical difficulties, segued into a way-too-brief introduction to the new integration platform @anywhere, got interesting for a little while, then became mired into  me-centric, smug ramblings of an interviewer who appeared more interested in showing off his own intelligence than in extracting juicy bits from the interviewee. Eventually the whole thing turned into a train wreck, with audience members walking out in droves. The back-channel was brutal to Haque, and attendees were walking out in droves. A full third of the audience left out of boredom after half an hour. Almost embarrassing to watch.
Continue reading “Evan Williams Keynote Interview”