The Ultimate OS X Text Editor – Coda

Just yesterday I was recommended a new text editor for the Mac. It’s called Coda and I’m loving it! Here’s why:

  • The layout is really nice, it makes good use of your whole screen with a single editor window.
  • It has an innovative “sites” feature that takes a screen shot of all your project’s home pages, which serves as a nice way to browse them.
  • It has built in SFTP support – if I’m honest, I was getting a bit fed up of TextMate + MacFusion to access all our sites.
  • It has a built in terminal, so you can instantly SSH to your servers as the same user as you use for SFTP.
  • It supports subversion, you can commit and update from the file browser side bar.
  • It has a collaboration mode, so you can simultaneously edit the same script as a co-worker.

panic-coda

Coda Keyboard Shortcuts

  • CMD + 2 – Switch to edit mode for the currently selected file.
  • CMD + 3 – Switch to preview mode for the currently selected file.

Creating a Virtual Host with Webmin

These instructions apply to Webmin version 1.450
  1. Create a folder where you wish to store your sites files. 
    • You can do this in the Others > File Manager section. 
    • We typically use something like: /sites/domainname.com/http/
  2. Setup the vhost.
    • Click on Servers > Apache Web Server in the left hand menu.
    • Click the “create virtual host” tab.
    • You can leave most settings as their default values, but you should fill out the following:
      • Port: Generally, you’ll want to use port 80.
      • Document Root: This is folder where you site’s files will be stored. Pick the folder you created in step 1.
      • Server name: This is just your site’s domain name, e.g. domainname.com (leave out the www.)
    • Click “Create Now”
  3. Add a server alias for www.domainname.com 
    • Click on the “Existing Virtual Hosts” tab in Servers > Apache Web Server.
    • Click the virtual server you just created.
    • Click on “Networking and Addresses”
    • In the “Alternate Virtual Server Names” box, add any additional server aliases you want to use for this site, such as www.domainname.com
    • Press “Save”.
  4. Click “Apply Changes” to get Webmin to restart Apache.

    Changing the default Umask on OSX Leopard

    We use Macfuse to connect to our office development services. It lets us mount remote folders via SSFHS. The problem is that when we create a file via this connection, the default permissions are missing the group write bit, and so other users who connect to this system can’t write to them.

    There is a fix available for OS X 10.5.3 and above – http://support.apple.com/kb/HT2202

    One of our developers at Fubra has released a small package that automatically fixes the umask settings this for you. You can download it here

    Or if you want to do it yourself via the command line, I’ve written some brief instructions. Basically, it involves 2 steps.

    1. Open up the Terminal application, and then create a file called /etc/launchd-user.conf 
    2. Add a line to the file containing the umask setting you want, in our case this was umask 002 

    Commands

    sudo vim /etc/launchd-user.conf
    umask 002

    NB: This sets the umask for every user on the system. So be careful what you choose!

    PHP Web Application Security

    Here are some tips to help you think more about security when developing a web app. 

    1. Buy a good book on the subject, such as Securing PHP Web Applications and implement what you learn in your code.
    2. Read through Web Application Security section on of the SANS Institute 2007 top 20 security risks. There are some useful tips on securing PHP in particular. 
      • Check PHP configuration settings:
        • Turn register_globals off, use super globals such as $_GET instead (from PHP 4.2.0 this is the default).
        • Turn allow_url_fopen off (unless you really need it).
        • Disable magic_quotes.
        • Configure open_basedir for each site to restrict access from PHP scripts to certain directories.
        • Consider running PHP with FastCGi instead of mod_php
      • Use best practices when developing:
        • ALWAYS validate user input! This is probably the most important point in the entire list. There are many nasty bots and spiders going round the web trying to break into your site, and the most common way in is through your web forms. There are various validation libraries out there to make your life easier  (e.g. PEAR Validate, Zend Filter Input)- use them!
        • Avoid SQL injections. If you validate user input correctly, then this should help you avoid SQL injection vulnerabilities. To be doubly safe you could use a database abstraction layer, that if used correctly with prepare statements, will automatically escape user input data. Check out PDO and Zend DB.
        • Avoid XSS attacks. An XSS attack is where malicious users are able to inject their own code in to pages on your site that may be viewed by other users. You could strip tags from user input, and encode html entities in any plain text being output.
        • Don’t transmit passwords and other secret information over plain text, submit to a secure URL.
        • Be careful when allowing uploads. Check the file types, and only allow files you expect. Resample uploaded images in case there is any hidden code inside.
        • Use sessions instead of cookies, unless you really need the persistence of a cookie. Sessions are temporary and keep everything except the session ID hidden from the user’s machine.
        • Peer review your code. Get another developer to look through it, two heads are better than one!
    3. Download the Wapiti and Grendel Scan web application vulnerability scanning tools and run them on your sites.

    This is of course an overly simple list, and it can’t protect against things like logic flaws, but at least – if you were wondering where to start then I hope it will give you some useful inspiration!

    Sharing a CD/DVD drive over the network with OS X

    Problem

    I’ve got a Mac Mini with a broken DVD drive, but I wanted to install iWork on it from the installation DVD. 

    Solution

    I used the Remote Disc feature of Leopard that Apple developed for the diskless MacBook Air to share another machine’s drive over the network.

    Instructions

    On the client machine were you would like to use the CD / DVD, you need run 2 commands on the terminal.

    defaults write com.apple.NetworkBrowser EnableODiskBrowsing -bool true
    defaults write com.apple.NetworkBrowser ODSSupported -bool true

    Then restart your computer.

    Next on the server machine where you will be inserting the physical disk, you must enable CD / DVD sharing in System Preferences > Sharing.

    CD & DVD Sharing with Remote Disc

    Once you’ve done that, insert your CD or DVD and then you should be able to connect to it via finder on the client machine.

    Cloud Hosting Providers

    Over the past year or so there has been a massive surge in the amount of companies offering Cloud Hosting services. In this post I’m going to outline the key players.

    There are also some Cloud Management Platform providers, who generally offer tools to help you work with other Cloud Hosting services, these include:

    And there are even some open source projects to help you build your own cloud:

    • Eucalyptus – Elastic Utility Computing Architecture for Linking Your Programs To Useful Systems – is an open-source software project for implementing “cloud computing” on clusters. Essentially a vendor neutral, EC2 compatible cloud platform.
    • Nimbus – An open source toolkit that allows you to turn your cluster into an Infrastructure-as-a-Service (IaaS) cloud.

     

    Go Grid

    Go Grid allows you to deploy and manage your own virtual servers from their control panel. The servers can be of 4 main types: Load Balancer, Web / App Server, Database Server and, Cloud Storage.

    The site doesn’t give a lot of detail about what happens once you’ve created your servers, apart from to say they are Real servers with Full Access. Presumably you would then need to configure the software (Apache, IIS etc..) on each server individually.

    Billing Model

    GoGrid charges based on Server Ram Hours and outbound data transfer. CPUs and Storage are fixed relative to the RAM chosen for each vserver.  

    CPU’s are guaranteed at a minimum ratio of 1 Xeon Core per 4 GB of Ram, therefore if you create a server with 1GB of RAM, it will have 1/4 of Xeon Core reserved for it’s use.

    Server RAM Core Guaranteed 
    (P4 2.0 GHz equivalent)
    Core Burst
    512 MB 1/8 1
    1 GB 1/4 1
    2 GB 1/2 1
    4 GB 3 3
    8 GB* 6 6

    Storage is also determined by the amount of RAM chosen for each vserver, however additional storage can be made available through the Cloud Storage system.

    Server RAM Storage
    512 MB 30 GB
    1 GB 60 GB
    2 GB 120 GB
    4 GB 240 GB
    8 GB 480 GB

    1 x 1GB RAM x 24 hours x 30 days = 720 Server RAM/hours.

    Prices start from $0.19 per Server Ram hour, therefore a 1 GB / 0.25 Xeon Core machine would cost $136.80 per month. However this would drop as low as $57.60 on their Enterprise plan, with a minimum commitment of $2499.99 a month. Bandwidth charges would be on top of this, and they start from $0.50 per Gigabyte dropping to $0.17 per Gigabyte if you commit to 6 TBs a month ($999.99).

    Summary

    Go Grid is currently very much a “build your own cloud” solution. The system will not scale automatically to adjust to spikes in demand, you would need to anticipate them and create spare capacity in advance.

    Amazon Web Services

    Amazon Web Services consists of 3 main products:

    • Elastic Compute Cloud (EC2) – A xen-based virtual server hosting platform. You can upload machine images to their platform, and then run them as virtual servers. 
    • Simple Storage Service (S3) – A cloud storage solution. Let’s you store files safely and reliably in the cloud.
    • CloudFront – A content delivery network enhancement to S3 that copies your files to a global network of edge servers. Requests for files are automatically routed to the nearest edge location, so content is delivered with the best possible performance.  

    Billing Model

    CPU power is measured in EC2 Compute Units. One EC2 Compute Unit provides the equivalent CPU capacity of a 1.0-1.2 GHz 2007 Opteron or 2007 Xeon processor. There are 5 main instance types, each providing a different level of processing power, storage and memory.

    Prices for EC2 Unix / Linux instances hosted in the United States are as follows:

    Standard Instances Price CPU Memory (GB) Storage (GB)
    Small (Default) $0.10 per hour 1 1.7 160
    Large $0.40 per hour 4 7.5 850
    Extra Large $0.80 per hour 8 15 1690
    High CPU Instances
    Medium $0.20 per hour 5 1.7 350
    Extra Large $0.80 per hour 20 7 1690

    A small instance running continuously would therefore cost approximately 0.10 x 24 x 30 = $72 per month.

    Bandwidth is charged on top of this at the following rates:

    Data Transfer In  
    All Data Transfer $0.10 per GB
    Data Transfer Out  
    First 10 TB per Month $0.17 per GB
    Next 40 TB per Month $0.13 per GB
    Next 100TB per Month $0.11 per GB
    Over 150 TB per Month $0.10 per GB

    Summary

    Amazon web services is a very competitively priced platform that offers a great deal of flexibility, however it also requires a fair amount of technical expertise to get up and running and it doesn’t come with any load balancing system, so you would have to build your own.

    To address these problems, some third party companies have emerged who offer control panel and management systems for AWS. Examples of such companies include RightScale and 3tera. Their products are sometimes referred to as Virtual Private Data Centres, or Cloud Management Platforms. 

    Rightscale offer Website Edition package, which comes with all the tools and images you need to deploy a load balanced web / database cluster on AWS. For $500 a month, it will let you manage up to around 20 servers.

    PHP Adsense Report Script

    Currently there is no Adsense API for accessing account statistics / reports. Fortunately, Alex Polski (Victor Klepikovskiy) runs a project on Google Code that provides a PHP class to login and download a variety of reports from Adsense. 

    So, if you want to monitor your Adsense reports in your own systems, you should give his PHP Adsense Account Library a try. 

    It supports:

    • Parse overview stats into an associative array.
    • Shows quick stats for Today
    • Show quick stats for Yesterday
    • Show quick stats for Last 7 Days
    • Show quick stats for This Month
    • Show quick stats for Last Month
    • Show quick stats since Last Payment
    • Get a specific report as a CSV file
    • Get a specific report as an associative array.

    Installing Zend Framework on OS X (Leopard)

    Today I needed to use Zend Framework on my iMac’s local web server, so here’s how I installed it. 

    I prefer using subversion where possible to download any open source projects, and since Zend have an svn repository available I decided to use that. 

    sudo svn co http://framework.zend.com/svn/framework/standard/branches/release-1.7/library/ /usr/lib/php/libraries/zend-framework-1.7/

    This will follow the latest updates to version 1.7 – you can simply run svn update anytime a minor version is released.

    You can then include this in any of your projects with:

    set_include_path(
    get_include_path().PATH_SEPARATOR.
    '/usr/lib/php/libraries/zend-framework-1.7/');

    Although I’ve gone through these steps on my OS X Leopard workstation, they would also work equally well on other Unix / Linux distributions like Ubuntu, Centos, Fedora etc..

    Mollom beats Akismet at blocking spam

    I’ve been using the WordPress Mollom plugin for about 6 months now, and I have say that I’m very impressed. In that time, I can count on one hand the number of spams that have slipped through the net. When I was using Akismet, spam comments were getting through daily.

    Here are the stats that Mollom produced for my blog:

    mollom-statistics

    Which anti-spam plug-ins do you use on your blog? and how successful are they? Let us know by posting a comment!

    Granting site administrator permissions with WPMU

    It took us a while to work out how you grant additional users the Site Administrator permission in WordPress MU. We were expecting this to be in the users page, but actually it’s hidden on the Site Admin > Options page.

    WPMU Site Administrator Permissions

    However, once you realise where the option is, it’s actually incredibly simple. You simply specify all the administrator usernames in a space separated list, and press save.

    On the edit user page you should then see that the users have Additional Capabilities: Administrator displayed.