1: Overuse of the options table:
get_option() and set_option() are wonderfully useful features, if used in moderation. If not used in moderation, they result in a hellish jumble of entries in the wp-options table. Instead of using many discreet entries, an “options” object or array should be serialized into a set_option() call. While this may be overkill for a very simple plugin, once you get to any number of options it is a necessity.

2: No NONCEs
This is such an offensive mistake it makes me cry a little. As I(and Mark Jaquith and Vladimir Prelovac and many others) have written, using nonces is a must for any plugin which takes options from a user. Strangely enough, the nonce field is included, but then never checked (WTF?). Without the use of nonces, a nefarious user can arbitrarily change your plugin settings, and possibly even take over your database. Particularly if there are

3: No SQL Injection Security
Not having nonces is one thing. It’s bad, but I’ve forgotten from time to time myself. But not even escaping input before putting it in the database is, to quote “Yahtzee”, pants on head retarded!. Escaping user input is probably the single simplest and most basic security. It’s the last line of defense against people replacing your header image with horrific porn. Don’t write code without it.

4: Unnecessary use of global variables
This exists on two levels:
A) In purpose.php, both $wp_query and $post are called into the function via global. While this probably won’t do any harm, globally including everything everywhere is what made earlier version of php such a nightmare and it looks messy. If you don’t need a variable, don’t include it.
B) $var1-$var4 are declared to static values at the top of the file where they will clutter up the global namespace. They are never accessed from their global context, they are always get_option()ed. In fact, the only reason they are declared here is so that they can be add_optioned into options. EVERY TIME THE CODE RUNS. That’s four superfluous function calls every single time the file loads. This should be done once, on plugin install. Not every single time WordPress loads a page.

5: Include vs. Require
I realize that this is pretty nit-picky, but, when including files that are required for the program to function, the appropriate function is require() (or better yet, require_once(). If the file is missing, the code to break while trying to include the file, instead of mysteriously throwing messages about redeclaration of functions.

In conclusion, while the concept of a plugin framework is laudable, Fire Studio’s implementation falls far short of any reasonable mark of best practices, and only serves to encourage worst practices.

1) Static JavaScript. Instead of using the *.js.php which I have been using, javascript templates are being parsed by a small JS templating engine and stored as static files. This should significantly cut down on the amount of time spent processing php. Each file is stored as filename-hashcode.js.

2) Bootstrapper. People have told me a) They don’t think it’s fair to count the size without jQuery (it probably isn’t) and b) They don’t want to load jQuery on every pageload. To that end, the default install will now include a tiny bootstrapper (hopefully under 200 Bytes) that doesn’t load the player until and unless someone actually wants to use them.

3) Single audio player. For legacy browsers, there will only be one player, the awesome Sound Manager 2 player. User interface will be provided via jQuery based controls. Using a single “invisible” player allows a consistent JavaScript interface for all the players, and, should help to

4) <audio> tag based player. This will probably be beta only in 0.7, but I want to move towards using the native browser implementation instead of flash. Using a javascript interface and sound manager means it should be a seamless user experience, and the only difference is whether the JavaScript is calling the sound manager js or the <audio> tag.

I’ll be at WordCamp in San Francisco this weekend, anyone who wants to bend my ear about a feature can do so. Twitter at jwriteclub to get together.

I am happy to announce the release of a new plugin today: µMint. Like my other µ plugins, it’s a small, lightweight plugin to (hopefully) do something useful. In this case, µMint allows you to painlessly integrate Shaun Inman’s Mint into Wordpress. Unlike the currently existent solution, µMint does not make use of iframes. Instead, µMint is designed to work with both the Exposé API, by Adam Livesley as well as the included API, µAPI for Mint. Furthermore, there is a development version of a connector whcih allows Wordpress to directly query Mint, when the two share a database.

µAPI does more than just get your stats, it displays them for you. You can have your choice of a sidebar widget, a dashboard widget, or both. And, in the µ plugin philosophy, stats are cached periodically to reduce the number of API calls required.

I think that µAPI neatly bridges the gap between Mint and Wordpress, and I hope you’ll give it a try.

µMint for Wordpress Dashboard

Although it has been generally well received, there is some controversy surrounding Chrome. Initial concerns hinged on the End User License Agreement — or EULA — specifically, terms it contains regarding the user’s intellectual property. In addition, there are serious questions about how much information Chrome collects and what, if any, anonomizations are made to the data before Google logs it.

The potentially offensive terms from the EULA relate to the intellectual property of the user. Specifically, Google more or less asserts a an unlimited license to anything you do with the browser:

11. Content license from you
11.1 You retain copyright and any other rights you already hold in Content which you submit, post or display on or through, the Services. By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services. This license is for the sole purpose of enabling Google to display, distribute and promote the Services and may be revoked for certain Services as defined in the Additional Terms of those Services.

(Emphasis courtesy of Gizmondo)

Although Google appears to have backed off of the EULA terms, there are still potential issues with the browser. As CNet’s Ina Fried reports, there are potentially serious issues with what and how much user input google tracks through Chrome’s “OmniBar”:

…Google will have access to any keystrokes that are typed into the browser’s Omnibox, even before a user hits enter…Google has every intention of retaining some of that data even after it provides the promised suggestions… the company plans to store about 2 percent of that data…along with the Internet Protocol address of the computer that typed it.

In theory, that means that if one were to type the address of a site–even if they decide not to hit enter–they could leave incriminating evidence on Google’s servers.

While I do plan to give Chrome a try, I think that at this point the only logical choice is to stay away from Chrome as a day to day browser.

Update: In addition to the flaws listed above, Google apparently couldn’t be bothered to patch the Java exploit in WebKit.

The photograph is married to the eye,
Grafts on its bride one-sided skins of truth….
~ Dylan Thomas

I have finally uploaded photos to some of my posts. I had been having trouble with flickr with regards to multiple accounts, etc, and have been generally annoyed with flickr lately. Recently, SmugMug was mentioned to me. After trying it out a bit I was quite happy with SmugMug and, as Ben Striling’s brilliant PhotoXhibit plugin supports SmugMug I was quickly sold on SmugMug.

So, enjoy the delicious photo goodness of . . . photos.

It’s been years in coming. And it costs about 188% of its original projected price. But Nick Negroponte’s “$100 Laptop” has finally arrived. To be more specific, mine arrived in the mail toady. What follows is my initial impression of the “XO” and some pictures.

Construction:

This is one area where the XO excels. The diminutive lappy is rock solid. One can imagine a post apocalyptic world in which the OLPC is the only technological reminder of an earlier era. I must confess to skepticism when I first read that the XO had a rotating screen. It seemed that the Achilles heel of laptops of 10 times the cost, would be unlikely to be sturdily implemented in a laptop less expensive than many DVD players

As advertised, the keyboard appears water resistant. Of course this is probably made somewhat superfluous by the fact that the “ears”, which cover the ports, are not secure enough to keep water out of the ports. So, yeah, the keyboard survived that dunking in a river, unfortunately, the top half is full of water.

Ergonomics:

The XO fails miserably when it comes to ergonomics. I second the comment that many others have made that the keyboard is too small for even the tiniest of hands. In addition, the key action is much too shallow, although there is a slight springiness to the action that keeps your fingers from feeling like you are pounding on a plastic board.

Apart from the problems with the keyboard, the “top” of the laptop — the screen side — is much too heavy. It appears that the bulk of the electronics are in the screen half. While this is certainly a novel approach, I suspect that the reason that most other manufacturers place the electronics in the base is the same reason that the XO fails in this regard: the unit is dangerously top heavy. And yes, the XO is very sturdy, but I cannot praise a design that seems designed to make the accidents inevitable in a device used by kids more likely.

Interface:

My initial impression of “Sugar”, the XO’s operating system, was quite positive, when I was running it under VMWare on an Intel core quad. Unfortunately, on the 433MHz AMD Geode processor, Sugar bogs down with only a few programs — called “activities” — running. In addition, one “fundamental” application, web browsing, fails miserably. It can be argued that the primary purpose of a computer like the XO is for activities like word processing. In the modern, web centric world, however, I think that a solid web browser is key. The XO’s browser only supports one tab. In addition, even moderately sized web pages are unmanageable given the impossible, stuttery nature of scrolling. Finally, flash claims to be installed, but not a single flash app that I tried to load — YouTube, Simpleviewer and an MP3 player — loaded.

Apart from performance issues, I am not sold on the layout of sugar. Instead of a traditional menu based system (K or Windows), Sugar employs a weird dock based system somewhat reminiscent of OS X, except it doesn’t really work. The dock surrounds the entire window when it is visible, much like a picture frame. In the short time that I used the XO, however, the “dock” was invariably invisible whenever I wanted to use it for something, and it invariably appeared as soon as I tried to do something near the edge of the screen — unless it didn’t. I cannot quite figure out the logic behind it at the moment, however, sometimes it seems to appear or not on a logic all its own.

Final Word:

While the XO is an interesting device, I, for one, cannot really recommend it either as a system for those in the third world, or anywhere else. While it came in close to on target price wise, that is actually not my main criticism. I think that it is amazing that they OLPC foundation is able to design a laptop for $188(ish). The problem is that it is so underpowered and difficult to use that it seems rather a waste at any price. Particularly given that many of the areas it is destined for lack clean water and available power.

In addition, all other criticisms aside, I cannot help but wonder at the logic of introducing youngsters to an operating system unlike anything they are likely to ever use once they advance beyond the XO. There are a number of operating systems in use around the world today. None of them bear significant resemblance to Sugar. How are students raised on this proprietary system supposed to transition to “real” computers?

Finally, the model for continued software development and troubleshooting for the XO relies mostly upon the users (children) writing their own software and providing their own service. Not only do I doubt both the ethical and moral efficacity of such a system, I rather suspect that the mesh networking and peer created software will spawn massive bugs and viruses that spread across the network.

In short, while an interesting experiment, I do not think that the XO will prove a viable solution in the wild.

Plus, she’s a Movable Type fangirl.

‘Nuff Said!

Despite the fact that I am not the world’s most dilligent when it comes to blogs — I’ve given up 2 over the past several years due to inactivity — I decided to start another one.  What’s going to be different about this blog? Well to start with, I am not going to try to write a rambling diary about inconsequentialities. Instead I am going to try and confine this blog to things of actual interest (to me): Computers/Coding, Airplanes, and anything else I find genuinely interesting.

We’ll see how it goes.