P16: Practical Progress

How Sarah Palin's Yahoo Mail account was hacked

You may have heard by now that Sarah Palin's Yahoo Mail account got hacked. It was her personal account, but allegedly she was using it for state business or somesuch.

More interesting to me is the story of how it was hacked.

Veracode Blog - Learning From Sarah Palin’s Yahoo Mail Compromise

Shockingly easy: they just used "password reset" and guessed some supposedly-private "secret questions". The article also points out why Gmail's password reset function is more secure.

Lesson: don't use "secret questions" that someone can easily guess about you -- or look up on Wikipedia!

My talk last night at WebTechNY User Group

Here are the slides to a talk I gave last night at the WebTechNY User Group

Google App Engine - WebTechNY Aug 2008 - Google Docs

The audience was mostly HTML/CSS developers, not the seasoned server-side developers that Google's own App Engine docs presume, so my pitch was very introductory-level.

Considering that I finished the slide deck at 4PM and my talk started at 6:30PM, I didn't really want to advertise this much. :) Still, and in spite of it being August, I think we had 17 people in the audience. Several folks peppered me with some very astute questions. Privacy, whether to trust Google to our data, was a big concern. I told them my personal opinion on the matter -- but I am not a lawyer, so please use your own judgment.

I met Ashod, the founder of the WebTechNY user group, at the NYC App Engine "hackathon" back in (May?). He was enthusiastic but seemed a bit out of his element, so I tried to help him. I must have impressed him somehow as being an expert, so this talk is the result. :)

AppEngine: Installing PIL on OS X 10.5.3

The just-released 1.1.0 API for Google App Engine contains a new "Imaging" library. Hooray! It works by providing stubs, which use Python Imaging Library (PIL) in development, and some-other-machine-behind-the-curtain when you deploy to Google.

So, if you're developing for App Engine, you now need PIL on your development system too. Google provides a Installing PIL document. Unfortunately, their directions re: OS X are not quite right:

• "Download the Mac installer from the http://pythonmac.org."
• "Install the package"
• "Finish the installation ..."

Alas, that package will refuse to install if you are using the original Python interpreter that ships with Mac OS X.

After hitting this obstacle and wasting a half hour digging through obsolete HOWTOs, I found this nugget in the pythonmac.org Leopard page:

4. In Terminal, create a symbolic link for the system's Python.framework in the location expected by the pythonmac.org tools, like so:

cd /Library/Frameworks
sudo ln -s /System/Library/Frameworks/Python.framework/ Python.framework

Yes, you can skip steps 1-3 and jump directly to 4 if you just want to PIL, not IDLE or anything else. Now run the PIL installer. It should work!

You also need to add the PIL install location to PYTHONPATH. Stick the following in ~/.bashrc.

export PYTHONPATH=/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/

Now open a new terminal window, and type:

python -c "from PIL import Image"

If you don't see an error message, you're done. :)

Things I want to ask the Google App Engine team

Notes for the Google "hack-a-thon" tomorrow. Hopefully I'll get some interesting responses!

1) Image upload/resizing: db.BlobProperty will store it, but resizing not possible?

• Issue 38 " Please add Python Image Library (PIL)"
• Picasa GData API - is this a viable solution?

2) Full-text Search: Doable, but limited. See google.appengine.ext.search.SearchableModel

• Thread: Indexing Large Chunks of Text for Search | Google Groups
• Google Base API - is this a viable solution for a listings site?
• "We don't accept auction items without a fixed price on Google Base" (from Google Base Help). Bummer...

3) Schema updates: how is this handled? It appears that there's zero support for schema migration/rollback. Something like RoR's ActiveRecordMigration would rock.

4) How about a "Certified Developer" program? Give small-time developers an incentive to learn your technology stack, and an imprimatur when they do, to help them bring other parties to your platform faster. (think: MCSE and similar programs by Sun, Cisco, Oracle, Apple, Red Hat, Ubuntu)

5) Batch processing? Will we get Python MapReduce with access to the App Engine (BigTable) datastore? :-)

Google App Engine - First Impressions (one week in)

One week ago I said I was diving head-first into Google App Engine development. 'Tis true! I've now gotten my feet and head thoroughly wet. :) Here are my first hands-on impressions of App Engine as a web programming model.

I am porting an app that was already half-written in KohanaPHP and CouchDB with a custom, half-baked modeling layer. Roughly speaking, it is a Craigslist clone: an online classified listing site. Nothing revolutionary, this kind of site has been built a hundred times. I have a specific niche market in mind, and I hope to launch it soon.

Since Craigslist is arguably the simplest useful, high-traffic site on the internet, this seemed like a reasonable test of App Engine as a hosting platform. To put it another way -- if I can't recreate Craigslist on this platform, what good is it? :)

Diving head-first into Google App Engine

(If it looks like a turbine, do I want to dive in??)

I've previously mentioned how much I like the idea of Google App Engine. It's a neat model for web service hosting, and it promises to be really cheap. But considering that it's brand-new and unproven, I was happy to sit on the sidelines and let the rest of the market help shake out the bugs. Certainly, I wouldn't recommend it to any client just yet.

But I just found out that Google is hosting a hack-a-thon in their New York office next Wednesday. It's a free, all-day event. Hmm! So I signed up. I haven't gotten my App Engine trial account yet, but I can probably fix that onsite.

As luck would have it, I have been cobbling together a new personal site project this last month. I was using PHP with Kohana and CouchDB -- none of which are usable in the GAE environment. I'll have to rewrite in Python using Google's own datastore. But aside from this one-time cost, my project seems like a good fit for the App Engine environment -- especially since the hosting is free for now.

Two major GAE limitations which will bite me:

• No way to resize image uploads. (No GD, no PIL.) Doh!
• There is some support for full-text search, but it's a crude hack for the moment.

I absolutely need these for my project. But... phooey, I'm just going to dive right in anyway. Worst case, I can run a standalone image-resizer thingy on Amazon or maybe Slicehost until Google sorts this out. Plus it will be fun to beat some Googlers up about this next week. :)

Google App Engine. It's about time.

The big web-geek announcement this week was Google App Engine. Lordy, does this ever look neat. I like Don MacAskill's take the best:

I think it’s interesting that Google has basically taken a sniper scope out and aimed it at a specific cloud computing target. App Engine is only for web applications. No batch computing, no cron jobs, no CPU/disk/network access, etc.

I think this is very smart of Google. Rather than attacking Amazon head-on, Google has realized there’s a huge playing field for cloud computing, and are attempting to dominate another portion of it, one where they have a lot of expertise. Very good business move, imho.

I use Amazon EC2 -- their "cloud computing" solution" -- for some peripheral tasks at Flix55.com, and I like it a lot. But building a web app that can dynamically grow/shrink the number of nodes it's using -- that's hard, but it's also necessary to fully exploit Amazon's rent-a-server-by-the-hour pricing model.

App Engine promises to give you dynamic front-end scalability for free. Better yet, if the site has only modest traffic and data requirements, it's hosted completely free.

Gotchas? Oh Yeah! ... No pricing model for real traffic & storage levels yet. No SLA yet. Must use Python to develop your app (but I like Python). You have a funky datastore that doesn't allow joins, not an RDBMS. The list goes on...

But. Still. It's cheap cheap and hacker-friendly. It looks fantastic for solo-developer projects that are really experimental and may/may-not be the next big thing. This is also just Google's starting point for the service. Like EC2, it will get better in time.

I have plenty of hare-brained web ideas that I can't economically justify building even on EC2. Now, thanks to Google, it might be worth giving them a spin. I've already signed up... awaiting my trial account now. :)