Category Archives: Uncategorized

PyProxy hijack logic

So PyProxy is a mostly operational death star able to successfully sit between any website and the browser, one of the latest additions I made was the following inject for html payloads:

<script>
    (function(){
        var original = document.write;
        document.write = function(arg1){
                        console.group("document.write");
                        console.log("doc.write: " + arg1);
                        console.groupEnd();
                        original.apply(document, arguments);
        };
    }());
    
    (function(){
       var truImage = Image;
       window.Image = function(width, height){
        try{
            
            this.root = new truImage(width, height);
            this.__defineSetter__("src", function(val){
                console.log("New Image @ " + val)
                this.root.src = val;
                
                });
        }catch(Err){
            console.log("New Image Err");
        }
       }
    }())
</script>

It’s abomination code yes, but it is also extremely useful for further illuminating what exactly is going on in the time prior to document.onLoad plus exposes image beacons generated using Javascript Image objects… something that normally doesn’t show up any where in the DOM, hence I don’t believe FireBug or Chrome inspector panels can report it.

Normally to get something like this into a website would require adding it into development, which then opens the risk of it slipping into production.

The functional beta of PyProxy should be released this weekend if I don’t go on a bender.

Pulling cheap tricks with JQuery

Let’s say you got some tabular data with input button/anchor tags that ideally will cause previously hidden data to appear.

Attempt 1 went like:


//Simulated row

  Click me to show stuff!
Blah blah blah....

I hate messy code, but unfortunately this is PHP so there’s only so much one borderline pyschotic developer can accomplish. Or is there?


//prior to my table
            $('a.actionable').live('click',function(){                
                $($(this).attr('href')).slideToggle();
                return false;
            });

//Now 

  Click me to show stuff!
Blah blah blah....

It’s almost elegant if you ignore the PHP inject. JQuery’s .live handler automatically routes all unhandled click events to the closest “.actionable” classed element, then inside the live event handler, you grab the anchor’s href value to get the element Id of what you want to edit.

Stupid PHP tricks: The Array builder

class ArrayBuilder {
    public function __set($name, $value){
        return $this->$name = $value;
    }
    
    public function __call($name, $value){
        if(count($value) == 1){
            $this->$name = $value[0];
        }else{
            $this->$name = $value;
        }
        return $this;
    }
    
    public function toArray(){
        return get_object_vars($this);
    }
    
    public static function FACTORY(){
        return new ArrayBuilder();
    }

}

Usage:

  $x = ArrayBuilder::FACTORY()->hello("World")->digits(1,2,3,4,5)->foo("BaR?")->toArray();
  var_dump($x);
   array(3) {
  ["hello"]=>
  string(5) "World"
  ["digits"]=>
  array(5) {
    [0]=>
    int(1)
    [1]=>
    int(2)
    [2]=>
    int(3)
    [3]=>
    int(4)
    [4]=>
    int(5)
  }
  ["foo"]=>
  string(4) "BaR?"
}

Works great for factory scenarios and confusing the $*&! out of the unwary.

Thoughts on my corner of the Web industry

I’ve been busy with professional contractination work, which is a word I just made up to describe the chaos that goes on while being vetted for a new client. “Do you know PHP5?”, “What is class inheritence?”, “What’s the difference between include and require?”, etc. I wish I could make a indexed video of me answering these questions but I don’t think that would work for some reason. Still its just par for the course and I really don’t blame the client or the client’s gatekeeper asking because I’ve been on the other side of the fence, vetting out people and its a miserable task.

My resume shows 5 years of contract work and I’ve got half a dozen references ranging from developer peer’s to team managers and c-letter people…but from what I’ve seen none of that matters. Out of respect for all involved, I won’t be mentioning names, employer, or anything specific. Last thing I want is to kill someone’s career or tarnish a client’s reputation. That said, I’ve seen some pretty terrible “Senior” developers. What I mean by terrible has little to do with how they solve problems, but the fact that they don’t solve problems.

One recent case, I worked with a “Sr.” developer that proclaimed themselves “Team lead”, “Chief Architect”, and “Dev. manager” which was surprising because I finished three different projects on time and tested for production use in the time that this individual struggled with one project. Speaking to the CTO of the company I got to look at the person’s resume and it all made sense. They had been in the industry for 4-5 years as well, but 3 and a half of those years was as a “junior” developer in a fairly large team. Then they jumped or got booted and fell into my client’s company and became the defacto “Senior” developer because there was no one else. I think two things fed this person’s loose grip on their reality. In very large company’s, I’ve noticed that junior developers are not to be seen or heard and instead are programmers. They aren’t given opportunities to grow through mistakes and failures because that’s not what they are there for. Then the other side is that without peer review from competent peers… its easy to imagine your poop smells like roses.

Another case was a peer that got signed to the same company as me, both as contract to hire. One unique thing about this situation was that I knew NOTHING about the language or technology being used. The only saving grace is that the team leads had re-implemented a better/saner version of a framework pattern I had designed a few years ago. So of course I struggled in the first week and somewhat into the second week, but fortunately the language in use was imperative object oriented so everything eventually clicked for me. I won’t lie and say I was a super star, but I did my best to pull the line and help the team meet its goals. Meanwhile the other contract made a lot of mistakes: it’s generally a bad thing to hit on the female staff at work, if the product lead takes the time out to give you advice… its probably cause your fucking up, and lastly do not alienate your peers. Healthy dev. teams are like Survivor… if you become the weakest link and cause others to work harder to cover your ass, you will find yourself out of a job.

What I am getting at is that, in both cases it would be tough to figure out if someone can actually do the work needed for an employer. Their resume might look amazing or their credentials impeccable, but neither really mean much. The subject of vetting out good candidates has been covered over and over across the web and print…so I will keep my advice simple. If you have a small team or no team, go with established recruiting firms that will incur penalties to themselves if they recommend a dud ( generally 5-10 business days covered ) or if you do have a team, get them involved in the last stage interviews and see if this person fits in. I am sorry, I know this would seem to eliminate anyone who has text anxiety or social disorders… but time after time Geeks & Nerds recognize their own.

Slightly stuck

I freely admit I am probably over thinking the problem for the moment, but there is some doubts that maybe I am not. The problem is my concern of overloading Pymetheus with non-command & control messages, specifically low priority stuff like a chat scenario between user A & B. A types “Hey B, how’s it going?” which currently would need to descend down to a chat handler, run through some sort of sanitizer, then interface to auth.realm.UserRegistry to find the specific user, and then push a message to this person.

Its not really so bad to do this and in a lot of ways, it makes sense. All the information and constructs to accomplish the task is there, but it would need to be immediately refactor’d out at the first opportunity for one single reason: scalability. If Pymetheus suddenly starts taking on more and more trivial tasks, one day I am going to wake up and have this monolithic super process that does everything and has a memory profile similar to a swamp.

The ideal solution in my mind is:
User A & B connects and should be granted Chat privileges, accounts are created or activated on a xmmp server alongside pymetheus which returns connection credentials to Pymetheus which passes this back to each User. A & B now connect to the xmpp server and can chat away to their hearts content. Alongside some of the weirder xmmp sub-protocols this solves a whole slew of things that must be implemented ( presence, offline messaging, event notification, etc ).

A DRY abomination

One of my habits when presented with a new framework/platform is to implement a problem I know like the back of my hand. Usually the user interface isn’t of concern so I haven’t done much to improve on the logic there. I decided to try something different with this implementation of Tic-Tac-Toe:

Given the following

        
     
     
     

I used the following logic to determine the coordinates from a user click

var clickHandler = function(e){
//Recieves a plan/jQuery managed event object                    
       var element = e.target;
       var parent  = element.parentNode;                    
       var x,y;
       //Below is fine for 0-9 scenario's but will need to be refactored for more
       //advanced/larger grids.
       try{
            y = element.classNames().detect(function(cls) { if( /y\d/.match(cls)){ return true; }})[1];
            x = parent.classNames().detect(function(cls) { if( /x\d/.match(cls)){ return true;}})[1];
        }catch(e){
            console.debug(e);
            return;
        }
                                        
         console.log("Coordinate " + x + "," + y);
};

The cool thing about this, is that with jQuery I can do jQuery(“#myTable tr.x2 td.y0”) and get the exact cell I am looking for… or even crazier stuff like:
“#myTable td.y0” to select vertically down a row
OR
“#myTable tr.x0” to select horizontally.