WordPress Plugins : Demo Data Creator

Here is a useful plugin for all of you, WordPress developers – Demo Data Creator.   It generates a whole lot of test / demo data and populates your WordPress site with it.  No more lengthy copy-pastes of Lorem Ipsum into posts and pages, single user (hi admin) installations, and senseless “foobar” and “foobar2” categories.  Now you can populate your test or development environment with lots of data to help with previews, and all those issues around search, pagination, and things like that.

demo-data-creator

If you’d rather avoid the plugin and automate this kind of work yourself, make sure to have a look at WP-CLI – command line interface for WordPress, which, among others, has the “wp post generate” command.

httpoxy – a CGI application vulnerability for PHP, Go, Python and others

httpoxy

httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments.

It comes down to a simple namespace conflict:

  • RFC 3875 (CGI) puts the HTTP Proxy header from a request into the environment variables as HTTP_PROXY
  • HTTP_PROXY is a popular environment variable used to configure an outgoing proxy

This leads to a remotely exploitable vulnerability. If you’re running PHP or CGI, you should block the Proxy header now.

The RegEx that killed StackOverflow

Here’s an outage postmortem from the recent StackOverflow downtime.  It just shows you how easy it is to break things, even they were built by some of the smartest people around.  Programming is touch and there is no way around it.

Technical Details

The regular expression was: ^[\s\u200c]+|[\s\u200c]+$ Which is intended to trim unicode space from start and end of a line. A simplified version of the Regex that exposes the same issue would be \s+$ which to a human looks easy (“all the spaces at the end of the string”), but which means quite some work for a simple backtracking Regex engine. The malformed post contained roughly 20,000 consecutive characters of whitespace on a comment line that started with — play happy sound for player to enjoy. For us, the sound was not happy.

If the string to be matched against contains 20,000 space characters in a row, but not at the end, then the Regex engine will start at the first space, check that it belongs to the \s character class, move to the second space, make the same check, etc. After the 20,000th space, there is a different character, but the Regex engine expected a space or the end of the string. Realizing it cannot match like this it backtracks, and tries matching \s+$ starting from the second space, checking 19,999 characters. The match fails again, and it backtracks to start at the third space, etc.

So the Regex engine has to perform a “character belongs to a certain character class” check (plus some additional things) 20,000+19,999+19,998+…+3+2+1 = 199,990,000 times, and that takes a while. This is not classic catastrophic backtracking (talk on backtracking) (performance is O(n²), not exponential, in length), but it was enough. This regular expression has been replaced with a substring function.

Changing the face of Limassol

Limassol, Cyprus

My brother sent me the link to this forum thread (in Greek mostly), which contains lots of pictures for the current and upcoming real estate projects in Limassol, which are significantly changing its skyline.  It’s one thing to hear about these projects individually, and see the construction begin in different areas of the city, and a completely different to see them all together on one page.

It’s quite impressive!

Composer magic

Now that everyone is super comfortable with composer, I thought I’d share these two gems which I didn’t know or think about.

composer info

This command lists all of your packages installed with composer.  This is super handy if you want to include a page in your project, listing all the libraries and versions which are currently installed.  It also gives you a description of each library as provided by the package.

composer outdated

This command lists packages which you are using, which have updates available.  With this you can have a better understanding of what will happen if you run composer update (depending on your composer.json of course).

Update (July 21, 2016): Guess what? There is even a way to combine the two with one command: composer info -l .  This will list all the packages, with their versions and descriptions, and with an additional column of the latest version for each package.

10 Favorite Job Interview Questions for Linux System Administrators

As someone who interviews a lot of people (mostly for the web development positions though, not system administration), I’m always looking for more ideas on what to ask the candidates.  Today I came across “10 Favorite Job Interview Questions for Linux System Administrators“, which has a few of bits that I liked.

First of all, this GitHub repository is super awesomeness.  It also links to a few other resources with more questions and ideas.  Not only for sysadmin interviews.

Then, this one is funny, yet somewhat challenging:

2. Name and describe a different Linux/Unix command for each letter of the alphabet. But also, describe how a common flush toilet works.

It also checks that you know the alphabet.

9. Print the content of a file backwards.

“I like broad questions where each person could give a different answer depending on their depth of knowledge. My personal answer is 8 characters not including the filename.” – Marc Merlin, Google.

This one caught me by surprise.  My immediate thought was “tac some_file“, but that’s obviously not enough.  tac only prints the lines in reverse order.  Which is not the same as reversing the file.  Perl to the rescue, but I wonder what’s the most elegant way to do it without the scripting language.

As always, interview questions are not only useful for the interviews.  They are a good measure of your own knowledge gaps and habit pitfalls.  This time was no exception.

The History of the URL

The History of the URL is a brilliant compilation of ideas and resources, explaining how we got to the URLs we use and love (or hate) today.  In fact, the article comes in two parts:

  1. Domain, protocol, and port
  2. Path, fragment, query, and auth

Read them in whatever order you prefer. But I guarantee that you’ll have a number of different responses through out, from “Wow! I never knew that” and “I would have never thought of that!” to “No way! I don’t believe it“.

And here is one of the bits that made me smile:

In 1996 Keith Shafer, and several others proposed a solution to the problem of broken URLs. The link to this solution is now broken. Roy Fielding posted an implementation suggestion in July of 1995. The link is now broken.

After a year of using NodeJS in production

There are days, when I feel jealous of all the young kids playing around with new technologies.  I need a certain level of stability and acceptance of the technology before I can apply it to client projects.  And I need time, which is a very scarce resource lately.

And yet there are days, when I feel good about being somewhat reserved and conservative in my technology stack choices.  Reading this blog post makes me feel just that.  Of course I need to try it out for myself and shape my own opinion, but with my lack of time, this should do.

I spent a year trying to make Javascript and more specifically Node work for our team. Unfortunately during that time we spent more hours chasing docs, coming up with standards, arguing about libraries and debugging trivial code more than anything.

Would I recommend it for large-scale products? Absolutely not. Do people do that anyway? Of course they do. I tried to.

I would however recommend Javascript for front-end development such as Angular or React (like you have another choice).

I would also recommend Node for simple back-end servers mainly used for websockets or API relay.

Now if only somebody wrote a similar post about Docker …

Why Some People Get Promoted (And Others Don’t)

I enjoyed reading the article “Why Some People Get Promoted (And Others Don’t)“.  Unlike many other in this domain, it is simple, direct, and to the point.  TLDR version:

  1. Do great things.
  2. Tell people.

There are quite a few links to external resources, with research and insightful quotes.  Here are a couple of my favorite bits:

‘[S]ent does not mean received’ is a profound thing. Half of your job in this studio is doing your work, the other half of your job is communicating that it’s been done. Because if you do it, and I don’t hear about it, how do I know what’s going on? I’m not trying to control everything, but in an intimate work environment, where we’re really trying to develop something complex, a nod, saying, ‘I got it,’ helps move things along.

And this part, which resonates with my inner blogger:

Asking for help is part of getting better at your job.

3. Work where people can see you.

Gaining visibility might require going outside your office. Maybe you have a side project, or maybe your work culture isn’t a healthy environment to pursue visibility.

Promoting yourself doesn’t have to be on someone else’s terms. Write a book, start a blog, make a side-project, collaborate with new people outside of work, or speak at panels and conferences. Tell people about what you’ve done, what you’re doing, why it’s important, and how you did it. Give talks, teach others, raise your hand for new projects.

Wikiwand – Wikipedia Modernized

I came across an interesting take on WikipediaWikiwand.  It’s basically an upgraded and modernized design of the Wikipedia.  You can either search and browse it like you do with the regular Wikipedia, or, better even, install a browser extension (here’s one for Google Chrome), which will redirect all your Wikipedia page clicks through to Wikiwand.  You get exactly the same content, but now it’s actually quite pleasant to explore.  Have a look at Cyprus page, for example:

wikiwand

I’m not a frequent Wikipedia reader, but in the last couple of days, I have to say, I’ve found myself spending much more time than usual reading Wikipedia pages on the Wikiwand website.  Maybe, it is time for the Wikipedia face lift after all.

But it’s not just about forcing a different web design upon thee.  There’s more.  You get options (upper-right corner).  You can switch between light and dark designs, sans and serif fonts, adjust font size and text justification, and more. If you create account and login (Facebook is supported), you can bookmark pages too.

options

Even if you are not a fan of fancy websites, I suggest you give it a try for a couple of days.  You might find yourself quite surprised.