Banned Characters in Cookies in Tomcat

I was recently asked to look into why we had a problem with “[]” (square brackets) that were being passed to us as part of an affiliate id, eg: “SF_1234_[345]“.

It seems we were saving the value to a cookie. This works fine if you check the cookie values in the browser. However, when we tried to pull the value in Tomcat, it got truncated to “SF_1234_”

After some painfull research… I finally found a page on the Tomcat buglist that clarifies the issue, and breaks down the RFCs to manageable information.

The upshot it quite simple.

The following characters should never be used in an unquoted cookie value.

()<>@,;:\\\”/[]?={} \t

While they will work on some systems, anything that implements the RFC properly will break. As happened to us with Tomcat.

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

LHC: Large Hadron Collider: What could we discover…?

I am eagerly waiting for the first results to come out of the LHC, and the next, and then the ones after that…

The possibilities for advancing theoretical physics through experimentation are remarkably rare, so an event of this magnitude should be followed with interest. Whatever the results, physics is about to undergo a huge leap forward.

As long as we are still around to see it… {Joke}

However, I have a question regarding the nature of Time&Space that seems to have been ignored, as it is most difficult to find an answer. Either that or I am being an idiot… :->

What Happens to Time when there is no matter?

We understand that the presence of Energy/Matter causes gravity and the curvature of SpaceTime. In fact with enough energy/matter density we get a gravity well of such density that it is effectively infinite, i.e.: a black hole.

It should also be noted that gravity and time are linked. As gravity becomes bigger, time dilates and each period of time lengthens.

Until we reach the theoretical point: that a person (who survived) falling into the event horizon of a black hole would experience such extreme time dilation that they would be able to watch the end of the universe.

This seems to be the normal point of interest, and everyone stops there.

However, my question relates to the opposite.

The opposite of everything?

Before the Big Bang, when there was no matter or energy, there was nothing to curve SpaceTime.

What happens to time in this situation?
What is the shape of the curve?

As far as I can see there are two probably answers.

1. It is a simple curve, and time tends towards a fixed point

simple curve

2. It is a TAN like curve, where time tends towards infinite values.

tan curve

For some reason I rather like the 2nd answer, but I have been unable to find anything that would suggest this is the case.

It is an interesting theory, as given my assumption that Curve2 is correct: then all time before the Big Bang, i.e.: before the existence of energy/matter, would be contracted into an infinitely short period. At least from a theoretical observers point of view.

In effect the opposite of a a back hole, the opposite of a gravitational singularity with time dilation.

So my question is:
In the TOTAL absence of energy/matter, does time becomes a singularity.

Request for comment

I have been looking for an answer to this question for a few years. Can you help? Do you know anyone who has already considered or answered this?

Please let me know.

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

Speed Testing Chrome for List Processing

What are we testing?

As Rich Internet Application development progresses, more and more developers are moving towards the functional programming capabilities of JavaScript.

First Order Functions, Closures, Macros and Lists are becoming a mainstream method of development.

When you can tell the computer how to do it, rather that listing what it needs to do, it becomes much easier to write a program and needs a lot less code.

Think recipe instead of precise instructions.

So how does Chrome compare to the other browsers when doing this?

What did we test?

I used JSTR to create a re-usable test of basic Functional programming.

The test creates a list(array) from a DOM collection, runs a filter on the list to identify the required elements, then performs an action on those elements remaining.

Follow this LINK to run the test for yourself.
Paste the link into another browser to test it on different systems.

The test is pretty basic, but it provide a nice demonstration of the capabilites of Chrome.

So how did they do?

Testing 1000 loops on a windows XP machine with 2Gb ram:
Testing used 10 repetitions for averaging.

browser lisp times

Conclusions

It looks like the more modern browsers (FF3, Chrome, Safari) are now concentrating a great deal on Javascript performance. A very good piece of news for anyone developing Rich Internet Applications.

I must admit I was surprised by the performance of Safari on WindowsXP but it is nice to get surprises like this.

I had expected Chrome to out perform everything else and was a little disappointed to see otherwise. However, it is definetely a top notch Javascript system and I look forward to watching it develop.

This test does raise the issue that older versions of any browser will have significant differences in run-time speed for your application.

It looks like we will soon be back to the days of specifying a minumim compatible browser version, and the list will be quite short.

Request for Comments

If you have a different operating system or browser… can you please let me know how it performs in this test?

  1. Use the link above to launch JSTR, pre-loaded with the test..
  2. Clear the Console
  3. Press RUN

If you can leave a comment with the output, I will add it to the data collected.

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

How fast are chrome plugins?

It just occured to me, that, as the V8 javascript engine compiles JavaScript to native code…

…any plugin written in JavaScript should run at native speeds…

Does anyone have any more information on this?

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

Performance Testing in JavaScript

Fast pages and quick load times are key factors to keeping visitors on your site.
If you make them wait, they will leave.

So the speed of your JavaScript applications is crucial.

Fortunately, it turns out that JavaScript applications are ripe for performance optimization.

This requires a strong testing framework… enter JSTR.

String Concatenation Performance

A simple example of the type of benefit available from performance testing can come from testing String concatenation.

Javascript allows the use of “+” to concatenate Strings, but it turns out to be rather inefficient if you are building a very big string, eg: dynamically building HTML from AJAX.

Instead, the use of a Array (wrapped to provide a StringBuffer object) provides a huge boost in performance.

function StringBuffer() {
this.buffer = [];
}

StringBuffer.prototype.append = function append(string) {
this.buffer.push(string);
return this;
};

StringBuffer.prototype.toString = function toString() {
return this.buffer.join("");
};

var buf = new StringBuffer();
buf.append("this is being added");
alert(buf.toString());

To test this against a normal concatenation:
Copy the String below, and then paste it into the IMPORT function in JSTR.

jstr_StringBuffer=KHtuYW1lOiJTdHJpbmdCdWZmZXIiLCBkZXNjOiJUaGlzIHRlc3QgY29tcGFyZXMgdGhlIHNwZWVkIG9mIGJ1aWxkaW5nIGEgbGFyZ2Ugc3RyaW5nIGJ5IGNvbmNhdGVuYXRpbmcgc3RyaW5ncyBvciB1c2luZyBhIFN0cmluZ0J1ZmZlcihhIHdyYXBwZWQgYXJyYXkpLlxuQ29tcGFyZXMgYm90aCBsb25nIGFuZCBzaG9ydCBzdHJpbmcgYnVpbGRpbmcuXG4iLCBsb29wczoiMjAwMCIsIGl0ZXJhdGU6IjUiLCB0ZXN0czpbe25hbWU6InNob3J0U1RSIGNvbmNhdCIsIHNldHVwOiJhU3RyaW5nID0gXCJhZGRpbmcgXCI7XG5iU3RyaW5nID0gXCJTdGFydCBcIjsiLCBjb2RlOiJiU3RyaW5nICs9IGFTdHJpbmc7IiwgaW5jOnRydWV9LCB7bmFtZToibG9uZ1N0ciBjb25jYXQiLCBzZXR1cDoiY1N0cmluZyA9IFwiIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkIGFkZGVkICBMT05HXCI7XG5kU3RyaW5nID0gXCJTdGFydCBcIjsiLCBjb2RlOiJkU3RyaW5nICs9IGNTdHJpbmc7IiwgaW5jOnRydWV9LCB7bmFtZToic2hvcnRTdHIgU3RyaW5nQnVmZmVyIiwgc2V0dXA6ImVTdHJpbmcgPSBcIiBNb3JlXCI7XG5mU3RyaW5nID0gXCJTdGFydCBcIjtcblxuU3RyaW5nQnVmZmVyID0gZnVuY3Rpb24gKCkgeyBcbiAgIHRoaXMuYnVmZmVyID0gW107IFxuIH0gXG5cbiBTdHJpbmdCdWZmZXIucHJvdG90eXBlLmFwcGVuZCA9IGZ1bmN0aW9uIGFwcGVuZChzdHJpbmcpIHsgXG4gICB0aGlzLmJ1ZmZlci5wdXNoKHN0cmluZyk7IFxuICAgcmV0dXJuIHRoaXM7IFxuIH07IFxuXG4gU3RyaW5nQnVmZmVyLnByb3RvdHlwZS50b1N0cmluZyA9IGZ1bmN0aW9uIHRvU3RyaW5nKCkgeyBcbiAgIHJldHVybiB0aGlzLmJ1ZmZlci5qb2luKFwiXCIpOyBcbiB9OyBcblxuYnVmID0gbmV3IFN0cmluZ0J1ZmZlcigpO1xuYnVmLmFwcGVuZChmU3RyaW5nKTsiLCBjb2RlOiIgYnVmLmFwcGVuZChlU3RyaW5nKTtcblxuIiwgaW5jOnRydWV9LCB7bmFtZToibG9uZ1N0ciBTdHJpbmdCdWZmZXIiLCBzZXR1cDoiXG5oU3RyaW5nID0gXCJTdGFydCBcIjtcblxuYnVmMiA9IG5ldyBTdHJpbmdCdWZmZXIoKTtcbmJ1ZjIuYXBwZW5kKGhTdHJpbmcpOyIsIGNvZGU6ImJ1Zi5hcHBlbmQoY1N0cmluZyk7XG5cbiIsIGluYzp0cnVlfV0sIHZlcnNpb246MX0p

Just to give you an idea…
StringBuffer is just faster for short strings
and about 50 times faster for long strings…!

My thanks to Pavel Simakov for this.

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

A ‘foolish’ new tool for Javascript

I have been dying to shout about this…

instead I have been waiting very patiently…

BUT now it is time to SHOUT!

JSTR(Jester) is out of the box!

JSTR is the first ‘Browser based’ (ie:Cross-browser ):

  • Testing
  • Benchmarking
  • Optimization

tool for javascript.

With both import & export of Test-Sets, as well as auto-generated URLs, JSTR lets you easily share your code with everyone else, so they can try it for themselves.

Now, when you write about your new discovery, put a link to the test-set in your blog and let everyone else actually try it.

Find out about the new funny man for JavaScript.

Watch the video to learn more

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

Fixing an error building my first carbide.c++ project

I installed the Carbide.C++ IDE today, followed the tutorial instructions but got an error when I went to build the project.

Error: “bldmake returned with exit value = 2″

A little digging later and I found the solution…

Open a CMD prompt to the group folder of my project and run:

“bldmake bldfiles”

It told me that bldmake.pl was unable to be run…

Even though I have perl installed.

So now I know I have a problem with my perl install.

The simple fix was installing ActivePerl as originally suggested.

Now it works.

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

Secure your phpinfo from the bad people

I use the phpinfo() function a great deal, for basic information to advanced server administration checking, so I like to have it running on all my hosts.

Unfortunately this is a great hole in my security, as this information is a gold mine for the hackers out there.

I could simply remove the file when I am finished, or obfuscate the filename to make it difficult to find. But both of these would rather destroy the ease and simplicity I am looking for.

So, I decided to sort this out today.

The solution I am using is simple. Basic HTTP Auth.

Just enough to deter any would be hackers, as no-one can see how complicated my security is behind this shield. And, this should work on all PHP servers.

Here is the code.

function authenticate($uid,$pw) {
if (
!isset($_SERVER['PHP_AUTH_USER']) ||
!isset($_SERVER['PHP_AUTH_PW']) ||
$_SERVER['PHP_AUTH_USER'] != $uid ||
$_SERVER['PHP_AUTH_PW'] != $pw
){
header('WWW-Authenticate: Basic realm="Security Check"');
header('HTTP/1.0 401 Unauthorized');
echo "You must enter a valid login ID and password to access this resource\n";
exit;
}
if($pw == "password"){
echo "You must change the 'password' before you can have access to this...";
exit;
}
}
authenticate("admin","password");
phpinfo();

And a zipped version.

If you have a standard file with phpinfo() in it…
I highly suggest you start using this.

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

Timing is everything

Here for your delight.

A simple way to track timing in Javascript.

// TIMESTAMP Function
function timestamp(){return (new Date()).valueOf();}

// TIMER Function, wraps timing arround function call
function timer(f){
  var t1 = timestamp();
  for(var i = 0; i &lt; 1000; i++){
    f();
  }
  var t2 = timestamp();
  return t2-t1;
}

// The function to test
var testFunc = function(){
  var v = (window["DoYouBelieveInSpeedReading"])?true,false;
}
// Now call the timer
alert("time taken="+(timer(testFunc)/1000) + " seconds" );

The core is converting a date object into milliseconds: date.getValueOf(). This will give you a Long of the number of millseconds since 1970.

so var t1 = timestamp(); will store the start time.

Then do the thing you want to test… I would suggest a very large number of times… I needed to make it 100,000 for the Regex below.

and var t2 = timestamp(); becomes the end time.

Now totalTimeTaken = t2 -t1; in millseconds.

Finally time = totalTimeTaken/1000; to get the number of seconds that the function took.

I wrapped it all up in a function timer…

which can be called by
alert(”time taken=”+timer(myFunc)/1000);

I recently used this to test String matching functions, to find that indexOf is blisteringly fast, followed closely by pattern.test, and then way behind that String.match .

For 100,000 repetitions:
String.match: 1300ms
pattern.test: 360ms
String.indexOf: 180ms

So the moral of todays story is…

  • use indexOf if you can
  • pattern.test if you must have REGEX or more than one match
  • and AVOID String.match if you can

Just remember that premature optimization is a bad thing…

Happy Testing…!

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon

Setting an Exclusion Cookie for Google Analytics with a Bookmarklet

I have been doing a lot of work on my reading software website recently. This has played havoc with my Google Analytics reports.

So I set about looking for a way to block my own hits from the results. Having done a good search for up to date techniques, it seems that a cookie and a filter in analytics are still the current standard.

I came across loads of articles explaining all this, but none were really clear, so I thought I might cover the subject again. Partly for those who follow after me, and partly so I never need to research this again.

So for posterity here’s how to go about it.

Creating the Exclude Filter

I have written a seperate post on how to add an Exclusion Filter to Analytics in 10 easy steps with loads of screenshots.

How to add an Exclusion Filter to Analytics in 10 steps

 

Creating the Cookie

Rather than go down the route of having to install something onto my website, I decided to create a BookMarkLet to generate the exclusion cookie.

This means I can use it for any site, it is quick and simple to use and most importantly there is no need to install anything on the website itself.

Another benefit is that I can get anyone working on or reviewing my site to use it as well, without too much trouble. All in all, a win-win solution to the problem.

Get the BookMarkLet: Drag this link to your browser bar (add it to your bookmarks)
GA IgnoreMyHits

Then to put the cookie in place:

  • Go to the site you want to stop recording hits on
  • Click on the bookmarklet(above) you have stored
    • let it add the exclusion cookie to your browser.

First : choose you exclusion cookie name…

alert1

Then: Make sure it all worked. It will recognise your analytics install and tell you which one it detected.

alert2

 

If, like me, you use differant browsers for testing, make sure you do this with all of your browser,s rather than just your main one. This will ensure that your analytics results are totally accurate.

The only thing you must ensure is that you use the same name for both the cookie and the exclusion filter in analytics.

 

So there you go a nice quick simple solution for clearing up your Analytics results.

I would like to thank, Justin Cutroni , as his blog was the first clear explanation I encountered.

 

A shameless plug..

Bring the benefits of over 15 years experience in internet technologies, from programming through to usability & design, persuasive copy-writing and site speed optimizations.
Check out my consulting company, Technical Magic.

Share and Enjoy:
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Reddit
  • Slashdot
  • StumbleUpon
Byting the hand that feeds you…