Trevor Burnham

Sure, it works in practice…

Flicker-​​free Typekit

January 28th, 2010

I’m a fan of Typekit. Being able to go beyond the old Arial-​​Verdana-​​Times-​​Georgia paradigm, on any modern browser, without Flash (unlike sIFR), and with selec­table text (unlike Cufón), is a dream come true.

One problem, though: It takes a few mil­lisec­onds to load up and render those fonts. That’s not so bad in itself; what’s bad is that the browser renders every­thing in non-​​Typekit fonts first, creating an annoying flicker every time the page loads as the text gets replaced by fancier fonts.

For­tu­nately, there’s a fairly easy solution (though not an offi­cially sup­ported one—see below). Just add this to your site body:

1
2
3
4
5
6
7
8
9
10
11
12
13
<body id="domain-com">
  <script type="text/javascript" src="http://use.typekit.com/KIT_ID.js"></script>
  <script type="text/javascript">
    document.getElementById('domain-com').style.opacity = 0;
    setTimeout("document.getElementById('domain-com').style.opacity = 1", 1000);
    Typekit.load('KIT_ID', {
      afterLoad: function(data) {
      	setTimeout("document.getElementById('domain-com').style.opacity = 1", 1);
      }
    });
  </script>
  <!-- content goes here --> 
</body>

Then sub­sti­tute your actual domain for domain-com, and (impor­tant!) your site’s unique Typekit ID for KIT_ID. You can get this ID by logging in to Typekit, launch­ing the Kit Editor, and clicking the “Embed Code” link; it’s an 8-​​letter alphanu­meric combination.

Here’s a breakdown:

  1. The <body> ID on line 1 isn’t just a good selector; it’s good form. The most common con­ven­tion is to use your domain (with a dash instead of a dot), which makes things easier for the Grease­mon­key types.
  2. The script include on line 2 brings in the Typekit descrip­tion of your site’s kit. You can move this line up to your <head> section if you want.
  3. Line 4 makes your entire site dis­ap­pear. Because this is at the top of your body, nothing is going to get rendered. It’s impor­tant that this line be here, rather than in another file or even at the foot of your body.
  4. The call to Typekit.load does the actual loading of the fonts, and the afterLoad callback will be executed right after that happens. That’s when we want to make the body opaque again, right? Well, not quite. It seems that there’s a small delay between the callback and text refresh. For­tu­nately, using setTimeout to add a tiny delay (1ms) seems to elim­i­nate this, finally ridding us of the dreaded flicker.

Caveat: The afterLoad event is cur­rently con­sid­ered exper­i­men­tal. An official solution for avoiding flicker is likely to be added in the future.

Tags:       No Comments.

The Most Important IDE Feature

January 24th, 2010

Say you’re working on a project with hundreds of files. Changes to one file neces­si­tate changes in others in an unfath­omably complex tree struc­ture. Using File -> Open each time you need to switch files is time-​​consuming, which is why simple text editors have been widely aban­doned by pro­gram­mers in favor of inte­grated devel­op­ment envi­ron­ments (IDEs) that offer tabs and a widget that shows the file struc­ture at all times. This, more than syntax high­light­ing, is the reason why few projects are edited in Notepad.

But that’s still not enough. Why navigate the depths of a file tree when you can simply type the name of the file you want? This is the most impor­tant feature an IDE can offer. In Eclipse, it’s called Open Resource. In TextMate, it’s called Go to File. In Coda and Apple’s own XCode, it’s aptly dubbed Open Quickly, and goes one step further by per­form­ing full-​​text search on the files in the current project using Spot­light. Per­son­ally, I prefer the instan­ta­neous of the Eclipse/​TextMate approach; but either way, it’s cer­tainly faster than using the mouse.

If you’re a devel­oper who isn’t using this feature, find it. It will change your life at least as much as I’m guessing Quick­sil­ver already has.

Tags:   No Comments.

Stronger Passwords for a Stronger America

January 21st, 2010

Laptop secured with 4096-bit RSAOne thing that struck me when I was devel­op­ing Quocial last summer was that I was spending a stag­ger­ing amount of time on details that had little to do with the core func­tion­al­ity of my site. Thou­sands of little things go into making a webapp that works the way people expect. And yet, even when using a convention-​​over-​​configuration frame­work like Rails, devel­op­ers con­stantly stumble into common problems and spend hours rein­vent­ing common solutions.

So, I’ve decided to start cat­a­loging these frequent sticking points. Even­tu­ally, I’d like to organize them into a book, ten­ta­tively titled The Web Appli­ca­tion Check­list. But for now, I’m just going to post them here on an as-​​I-​​think-​​of-​​them basis, with the tag wach. These entries are rough drafts and subject to heavy revision.

Today’s item: pass­words. If your appli­ca­tion has enough of a need for security to require a password, it should require a good password. So when a user tries to create an account secured by the string 123456, just don’t let them. If their password is in the first 10,000 guesses that Password Recovery Toolkit might try, tell them to pick another. Then imple­ment some kind of throt­tling and/​or CAPTCHA. If you fail to do this, accounts will be hijacked. This goes double for admins: As Twitter learned, you can’t even trust your own col­leagues to pick good passwords.

Each time someone picks a password, run it by the Top 500 Worst Password of All Time. Reject it if it differs from anything in the list only by one or two char­ac­ters. There ought to be a good, standard, open-​​source library for doing this, but I’m not aware of any (sug­ges­tions?), so you might have to hack together some regex yourself.

And, for those of you who’ve never done this before, don’t forget to only store the hash in the database, and salt the hash. Here’s why.

[Update, 1/​21: Here is a nice overview of security concerns for webapps, includ­ing pass­words. And here is some JavaScript code used by Twitter after The Incident to reject common passwords.]

Tags:   No Comments.

From the Department of Obscure Media

January 19th, 2010

ConfidentalToday I received an unso­licited free trial issue of The Counter Ter­ror­ist, which touts itself as the “Official Journal of the Homeland Security Pro­fes­sional.” It’s a slick, glossy magazine that carries adver­tise­ments for explo­sives, body armor, military-​​grade first aid, thermal cameras, “throw­able tactical vehicles,” and (alarm­ingly) CBRN ensem­bles. It’s a Tom Clancy fan’s dream come true!

Most curious moment: An ad for bullets that are touted as both Cer­ti­fied Lead Free and offering Optimal Soft Tissue Pen­e­tra­tion. I get that lead bullets are a serious envi­ron­men­tal issue, but still, there’s some­thing odd about seeing these two claims in the same set of, er, bullet points.

I have no idea why I received this issue. It served as a nice reminder, though: Print is not dead. It just grew a longer tail.

Tags: No Comments.

Kings: A Libertarian Reading

January 16th, 2010

You might not have heard of the short-​​lived NBC drama Kings. It’s a modern retelling of the rise of David from humble Goliath-​​slayer to majestic ruler, but that’s not impor­tant. What’s impor­tant is the sheer pleasure of seeing a world much like our own, in terms of tech­nol­ogy and culture, that’s geopo­lit­i­cally stuck in the Old Tes­ta­ment. Picture The West Wing, but with the lovably pres­i­den­tial Martin Sheen replaced by a ruthless, theo­cratic dictator, King Silas, bril­liantly por­trayed by Ian McShane.

As with Deadwood, Ian McShane alone makes the series worth watching. But there’s some­thing else that struck me after a few episodes. If there is a message to the series, it’s this: Everyone loves King Silas for the occa­sional mercy that he shows. (Most acutely, we learn in episode six that there’s an annual holiday, “Judgment Day,” on which the king hears exactly ten appeals from the lower courts.) To us, the sophis­ti­cated, democracy-​​loving viewers, this is obvi­ously absurd: Why should the king get credit for rec­ti­fy­ing injus­tices that he merely restrains himself from com­mit­ting? And yet, any gov­ern­ment, even an elected one, is subject to this same paradox. Having an unques­tion­able king is just the extreme case.

I can’t say for sure whether King Silas is intended to be the complex, con­flicted, sinister yet sym­pa­thetic per­son­i­fi­ca­tion of “Big Gov­ern­ment.” But it’s cer­tainly possible to inter­pret him that way. Ayn Rand could learn a thing or two from Kings.

Tags:     No Comments.

Boycott www!

January 14th, 2010

There was a dark chapter in the early history of the Internet when, any time you wanted to go to a website, you had to painstak­ingly type “www.” in front of its domain name. This served a purpose of sorts: It told the server, in no uncer­tain terms, that you wanted to surf the World Wide Web. Never mind that the http:// prefix already said as much; Internet con­fig­u­ra­tion was a dark and untested art, and it just seemed safest to use sub­do­mains like www and ftp to be clear about which of your servers people were con­nect­ing to.

But then, as the mil­le­nium came to a close, and non-​​protocol related sub­do­mains like webmail and blog began to pro­lif­er­ate, the www prefix began to fade away. To be sure, it remained on many sites as a ves­ti­gial reminder of the days of dial-​​up and Netscape Nav­i­ga­tor, but most of the web’s denizens had learned that it could be safely for­got­ten. As hip new­com­ers like Twitter and foursquare dropped the prefix alto­gether, the augurs seemed clear: www was going gently into that good night.

Or was it?

Yes­ter­day, someone posted to Hacker News that the domain nasa​.gov is broken. You have to put www in front of it, or it won’t work. (Note that many browsers, like Firefox, auto­mat­i­cally put www. in front of the domain you enter if it can’t reach it without it. But the most popular browser, Internet Explorer, doesn’t.) I replied that it had to be a tem­po­rary glitch—some idiot added a new sub­do­main to their DNS records and acci­den­tally deleted the root!—but no, someone else pointed out, army​.mil and navy​.mil suffer from the same issue. It’s like they don’t want recruits who don’t habit­u­ally triple-​​tap ‘w’ before every web address!

Look: www has got to go. It’s a waste of bytes and time, our nation’s two most valuable resources. If you own a domain, here’s how to fix the problem:

  1. Find your name­server settings, specif­i­cally your A records. Make sure that your root domain is pointing to the same IP address as your www subdomain.
  2. Redirect www.yourdomain.com/whatever to yourdomain.com/whatever. If you’re using Apache, you just need to add the fol­low­ing to either your con­fig­u­ra­tion or a .htaccess file in the domain’s document root:


    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^www\.yourdomain\.com.* [NC]
    RewriteRule ^(.*)$ http://yourdomain.com$1 [R=301,L]

That’s it! Now if anyone tries to use www, even in a link to a specific page, they’ll still get to the right place. It’s so easy, even a rocket sci­en­tist could do it.

P.S. If you absolutely must keep www, at the very least allow those who omit it get where they’re trying to go. To do this, just modify the instruc­tions above by using these lines in your Apache config instead:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^yourdomain\.com.* [NC]
RewriteRule ^(.*)$ http://www.yourdomain.com$1 [R=301,L]

This is what Facebook does, for instance. But just as they dropped their super­flu­ous “The” (remember?), rest assured that there will come a time when Facebook​.com will truly stand alone.

Tags:   1 Comment

Sloppy Notation Costs Lives

January 12th, 2010

Blackboard equationsI had a grotesquely familiar expe­ri­ence in an econ class today: The prof drew up a simple example of a simple concept, yet no one—myself included—understood it. Why? Multiple incon­sis­ten­cies. A variable name meant one thing in the premises, and some­thing else in the con­clu­sion; a vector was used inter­change­ably with its distance; the matrix dimen­sions didn’t match up. Indi­vid­u­ally, each of these small errors could have been caught and cor­rected. But taken as a whole, they destroyed every trace of coher­ence. As a result, half the lecture was spent with the frazzled pro­fes­sor trying to clarify things, only to confuse the audience further, to the point that students were yelling, “Enough! Forget it! Let’s move on!” These are PhD-​​level students at one of the top econ programs in the world. Yet the sit­u­a­tion was so ago­niz­ing that it drove them to pan­de­mo­nium.

When will people learn? If you’re address­ing an audience, it is your moral imper­a­tive not to waste their time. In par­tic­u­lar, there are three goals you must pursue:

  1. Accuracy: Check your facts, and be rigorous
  2. Clarity: Address points of possible confusion
  3. Density: Convey as much infor­ma­tion as you can in as little time as possible

This doesn’t just go for math­e­mat­i­cal lectures. It goes for any inter­ac­tion with your fellow human beings, with the imper­a­tive growing stronger in pro­por­tion to the size of your audience. No matter how much you value your time, if you’re giving a talk that hundreds will attend or writing a book that thou­sands will read, you owe them your most strin­gent efforts. Think about it numer­i­cally: If you save 3,600 people one second each, you’ve just saved someone an hour.

The desire not to waste other people’s time has always been one of my defining traits. Not that I always succeed, but at least I’m embar­rassed when I fail. Some­times I worry that this men­tal­ity is not widely shared.

Tags:     1 Comment

Calculus: The Videogame

January 9th, 2010

Last semester, I took a graduate-​​level course called Videogames and Learning, taught by Barry Fishman of the UMich Edu­ca­tion depart­ment (who also teaches an under­grad version). Needless to say, the class is widely beloved, despite its dense syllabus of readings on the theory of learning and moti­va­tion. I decided to write my final paper on the question, “Why aren’t there any games that teach calculus?” (At least, not any suc­cess­ful ones.) There are some terrific games, like the Zoom­bi­nis series, that teach basic logic; and there are some com­pelling games, like the free online Lure of the Labyrinth, that teach arith­metic and algebra; but no one seems to have made a game that goes past the 8th-​​grade level. At the same time, no one has made an edu­ca­tional game as rich and immer­sive as, say, Mass Effect, a game so slick and well-​​written that it’s like living in the best sci-​​fi movie since The Empire Strikes Back.

Over time, I realized that this was not a topic con­ducive to academic pub­lish­ing, so the project drifted from a research paper to a design one. The result is an attempt to describe how a game could be made to teach calculus, proof method­ol­ogy, and ways of math­e­mat­i­cal thinking—all within the context of a gripping adven­ture. The paper is called Math Effect. I hope you enjoy it. And if you’re a game designer, I hope it gives you ideas.

Tags:     No Comments.

Perfectionism

January 7th, 2010

Bembo font sampleLet me tell you the tale of a real perfectionist.

There once was a Yale pro­fes­sor by the name of Edward Tufte. He wanted to write a book about the pre­sen­ta­tion of sta­tis­ti­cal data. It was going to be rich in plots and graphs, accom­pa­ny­ing the text on every page. Instead of tiny, clumsy foot­notes, or pageflip-​​inducing endnotes, it would have wide pages with margins per­fectly suited to his numerous cita­tions and inter­jec­tions. It was, alas, going to be an expen­sive book to print. And so, no pub­lisher would take it in its intended form. They would cheapen it, separate the images from the text, make it just another for­get­table academic treatise doomed to gather dust on library shelves. Rather than accept this fate, Edward Tufte decided to self-​​publish the book that would redefine his career: The Visual Display of Quan­ti­ta­tive Infor­ma­tion.

Now, when I say “self-​​publish,” you may have visions of Tufte upload­ing a PDF to iUni­verse and ordering a dozen copies. No. This was 1983. Self-​​publishing was an arduous and expen­sive process—but Tufte was obsessed. So, he went all in, taking out a second mortgage and setting up a printing press in his garage.

For­tu­nately, the book was a smashing success, the first in a tetral­ogy of books that have come to define the inter­sec­tion of design and sta­tis­tics. The books are hallowed in both industry and academia for making one of the nerdiest subjects imag­in­able into an utter pleasure acces­si­ble to any reader.

Within this epic arc, there is a smaller story that may yet secure Tufte’s visage a per­ma­nent place in the dic­tio­nary next to the word “per­fec­tion­ist”: When it came time for Tufte to convert his printing process to a purely digital one, it turned out that the digital version of the font he had been using, Bembo, was too spindly for his liking. Whereas an ordinary person would readily accept this minor defi­ciency (aca­d­e­mics commonly publish in Euclid, one of the spindliest fonts ever devised), or switch to some other serif, Tufte worked with pro­fes­sional font design­ers to design a new and improved version of his beloved typeface. Such atten­tion to detail is an inspi­ra­tion to us all.

And so, if you pick up Tufte’s latest book, Beau­ti­ful Evidence, and turn to the colophon seeking elu­ci­da­tion on the book’s typog­ra­phy, here is what you’ll find: “Composed in ET Bembo.”

Tags:   Comments Off

Smalltalk Lives!

January 5th, 2010

Byte magazine’s classic Smalltalk coverI was under the impres­sion that these days, you’re more likely to find Smalltalk in the History depart­ment than the Computer Science depart­ment. That is, until:

  • I read a great inter­view with Dan Ingalls, the “mother of Smalltalk” (Alan Kay is the father) in the excel­lent Coders at Work, in which he dis­cusses all the neat, fun things he’s been doing with the language lately, like Lively Kernel, a browser-​​based pro­gram­ming learning envi­ron­ment, and Squeak, which powers the One Laptop Per Child laptops, among other things.
  • I learned that Smalltalk powers DabbleDB. DabbleDB is a cool site that hosts spread­sheets in a much more web-​​like way than services like Google Spread­sheets, which are just trying to ape Excel in the browser (just as Excel aped Lotus 1–2-3, and Lotus 1–2-3 aped VisiCalc…).
  • All the other geeks inter­viewed in Coders at Work and Mas­ter­minds of Pro­gram­ming seem to like Smalltalk. C and its descen­dants (C++, Java…) get a lot of bashing, but Smalltalk is typ­i­cally treated with unadul­ter­ated admi­ra­tion. If lan­guages were on Rotten Tomatoes, Smalltalk would be 92% fresh.

I don’t think Smalltalk is going to make a Big Comeback (newer lan­guages like Scala are just too cool), but it’s def­i­nitely going to stick around for a while. And unlike the sticky, mal­odor­ous remnants of COBOL, I have no objec­tion to the clean, classic scent of Smalltalk.

Tags:   Comments Off