I got another new camera! The last two didn't work out for very long, but this one has promise. I won it at our recent Corporate Bowling event... it was clearly my best score ever at 167. I got second place and thus the camera. Woot!

This first image is one of Sophia's flowers. Sophia is the rose bush that Beth got from my family in condolence of her appendectomy. After almost killing her (Sophia, that is), I've nursed her back to health and we've been rewarded with new blooms.

Other than random events and trips, one thing I'd like more photos of is my balcony garden. Time lapse or something fun. I sit there and stare at the thing enough... I may as well share the green joy with the world!

Lets see... what what other sorts of boring photos do people put on their blogs... CATS! I must have some of those somewhere around here...

0 Add Comment

I've been using the Tree Style Tabs Firefox extension for a few months now, and love it! Having vertical tabs has always been fabulous, ever since I first encountered them in Galeon. The chrome-css hack that I have been using for the last few years in Firefox stopped working in Firefox 3 (beta), so I went exploring and am very glad I did.

Not only does the Tree Style Tabs extension give my my vertical tabs, it also gives me (surprise surprise) a tree of them! Each has it's own browsing history, and subtrees can be collapsed and reordered and all that wonderful goo.

Just now I was playing around with the settings and thought I'd try the auto-hide feature. I'm not sure I'll keep it because there is a slight flicker that bothers me... but it is neat none-the-less! The tab bar is hidden, and then when I mouse or keyboard activate it the bar appears translucently on top of the page. It might need some kinks worked out (or perhaps there is some other cause for the flickering), but I think I like it!

Highly recommended.

0 Add Comment

I love to create and build -- lately I've made a few songs! My friends like to play guitar and sing, and I play the harmonica and am learning guitar. So here are my recent creations (all with the help or in conjunction with friends):

• Umbrellas
• Zombie Love
• Immaterial Things

Only the middle one has a recording posted so far, but I'll get recordings of the others sooner or later. More to come I hope :)

Comments on TLT - 2008.03.30 - Making Music

Happy New Year!

I've been grappling with a concept for a long time now (years), and thought I'd put it down here to cast about for insight.

Here is one way to handle UI events:

$page->add_action(add_new => 'Add New Entry');
$page->display; # displays template, waits for input
$action = $page->get_action;
if($action eq 'add_new') {
  add_new_entry();
}

Here is another:

$page->add_action('Add New Entry' => sub {
  add_new_entry();
});
$page->display; # displays template, waits for input, runs callbacks

The first is quite imperative. Show the page. Give me the result. Examine the result. Act. The second is much more declarative. I declare that were such an action to occur, this is what you should execute.

The second is the way that Seaside handles things. I'm not quite sure why I'm reluctant to adopt this method... perhaps simply my lack of experience with this construct is to blame. I think it's some sort of voice in the back of my head that doesn't like it because it is a bit too much like desktop GUI callbacks. But why should that be a bad thing? It seems to work just fine for those applications.

I think I'm thinking about this too much.

0 Add Comment

Tonight I am doing a bit of work on the EPFarms User Panel and Effin, our financial database. The Panel is a Continuity application running under FastCGI and suexec. The security model is different from most other web applications I've done, we use suexec to run the application as the individual Eggplant Farms user.

Philosophically, running the panel as the user is an extension of our overall security model, which is to build as directly upon the unix security model as we can. The interesting aspect of this is that, since the panel is running without any special privileges, the user could modify or replace the panel and still have all the same security access. They also have all the same access from the command line.

Sharing dynamic data with the user, such as their current account balance, is a bit tricky. We also need the ability for the user to modify some of their own metadata. Our current plan is to create command line tools that allow them user-specific access to our data, which is stored in MySQL.

Another way, the one that I'm going to switch to after tonight's research, is to utilize some new features of MySQL 5. We'll use views to emulate row-level security, and MySQL's own column-level security to allow them to directly read, and as appropriate write, to our database. Though it's always handy to have a command line interface, the extra intermediary was a bit cumbersome.

Here's how to do it.

Lets say we have a single userinfo table, which just holds their username, unix id, full name, and emergency contact info. And heck, let's insert a few rows.

create table userinfo (
  userinfo_id int primary key auto_increment,
  unixid int,
  username varchar(100),
  fullname varchar(100),
  contact varchar(100)
);

insert into userinfo set
  unixid = 1001,
  username = 'awwaiid',
  fullname = 'Brock',
  contact = 'a@b.org';

insert into userinfo set
  unixid = 1001,
  username = 'aardvarq',
  fullname = 'David',
  contact = 'x@y.org';

Now we create a view, limiting to the current logged in user with the USER() function.

create view userview_userinfo as
  select *
    from userinfo
   where username = SUBSTRING_INDEX(USER(),'@',1);

Finally we grant some access to user 'awwaiid' (though really we could grant access to '%' if we were so inclined).

grant select on userview_userinfo to 'awwaiid' 
grant update (fullname, contact) on userview_userinfo to 'awwaiid'

Now when I log in as awwaiid I have access to my own rows, and can update my full name and contact info. The panel application logs into the database as the user, accessing and editing their data in a much more direct fashion than the command-line-wrapper method.

Comments on TLT - 2007.11.30 - MySQL Row Level Security