bytex64.net blog

Cross-site Authentication in the World of APIs

Tue, 01 May 2012 00:46:02 -0500

It used to be that some HTML displayed by your browser was the beginning and end of a website. Nowadays, with the ever expanding mobile world and the apps that go with it, it's just as important to have an interface built for machines in addition to the one built for humans. The API has become a staple feature of our modern web, and with it brings a new set of challenges for authorizing and authenticating users.

If you're a frequent reader, you'll know that I'm a pretty big fan of OpenID. But while working on some of my newer projects (notably Blërg), I realized that I couldn't really use OpenID authentication for the web APIs. The problem is that OpenID relies on working in the context of a browser. It redirects you to a webpage which authenticates you and redirects back. That obviously won't work if your endpoint is expected to return JSON. I've had grand designs of making all of The Dominion of Awesome work with OpenID for some time now, but as APIs become more and more a part of my projects, I'm going to have to leave it behind. I really believe in both OpenID and the utility of web APIs, so this was a really unfortunate choice for me.

As near as I can tell, there's no good "universal authentication" method for web APIs. There is OAuth, but it's designed for a wholly different purpose. OAuth allows a website to authorize a remote user to use its resources. It's not designed to provide authentication. You can use it to provide a "pseudo-authentication" service where the resource is the user's account information. OAuth can't work as a generic authentication service in this way though because the consumer application has to first get an API key and secret from the site providing authorization. This means I could authenticate against a specific service (like say, Twitter), but I couldn't allow users to authenticate with a service of their choice like you can with OpenID.

So the best you can do for now is to create your little enclave, and if it gets popular enough, other people can use you for API authentication if they ask nicely. Lots of sites are doing this now with Twitter or Facebook authentication. This is unfortunate because it means that while there's a huge breadth of applications and experiences on the web now, control over your identity is increasingly becoming the domain of only a few large entities. Where OpenID provided more freedom and options for users to choose their identity service, the need for APIs and the rise of OAuth is creating the opposite effect.

Where do we go from here, then? Well, the OpenID folks are working on a non-browser API called OpenID Connect. It's still very much a draft, so who knows when or if we'll see websites start to adopt it. Personally, I think I'll just stick with the tried and true method — use plain username and password-based authentication, and make management of credentials the user's problem. Hopefully OpenID Connect will come around just in time for something else to disrupt the Web as we know it. :-/

On the Buddha Nature of APIs

Mon, 23 Apr 2012 01:56:29 -0500

I've been working on rewriting Blërg in Enyo 2.0. It's forced me to think a lot about code reorganization and encapsulation of functionality, which is great. Enyo encourages encapsulation by giving you a flexible object model and generic event handling, but there's one sticky point that doesn't encapsulate well: the API object.

Particularly in the case of APIs involving authentication, an API object needs to keep some kind of state global to the application. Just as critically, an API has to be accessible from many different (and distinctly encapsulated) parts of an application. How do you balance these opposing needs? Or more to the point, how do you balance these opposing needs without doing something that software designers will frown upon?

A Meditation

First, some background on Enyo 2. Enyo classes are called 'kinds', and are defined with an anonymous object full of properties specifying functions, data, and behaviors. It combines functionality and object hierarchy into a single declaration.

Enyo extends the HTML DOM event model to allow the sending and handling of generic events. Events can also carry arbitrary data, making it a kind of message passing system that moves messages up and down an object hierarchy. To send an event up the hierarchy, you 'bubble'.

this.bubble('onDoSomething', {data: "stuff"});

And likewise, to send an event to all your children, you 'waterfall'.

this.waterfall('onDoSomething', {data: "stuff"});

With these, you can have objects send messages to other parts of the code without knowing where those parts are. For example, I have a login widget that bubbles a 'onTryLogin' event to the main object, which makes an API call and waterfalls the result (an 'onLogin' or 'onLogout' event) so that any object in the application can react appropriately. That last bit is really sweet — it completely decouples the UI changes for logout and login from the actual logic.

Events are handled in one of two ways. The first is to directly specify a handler function. This handles any events generated from the object or its children.

{kind: "onyx.Button", content: "Login", onclick: "trySomething"}

This handles a click event by running the trySomething function in the current object. (Event names that derive from DOM events are lower case. Generic events use camelCase.)

The other is to specify a handlers object in your object definition. This handles any events from your object or its children.

enyo.create({
    name: "MyObject",
    kind: "Component",
    handlers: {
        onDoSomething: "trySomething"
    },
    components: [
        // Any of these sending 'onDoSomething' will
        // be handled by 'trySomething'
    ]
});

A Koan

So back to our poser. How do we create an API object with global state but proper encapsulation? Well, the first obvious solution most of us come up with is to simply create a single instance and make it global. But that's not terribly elegant, and in slavish adherence to OOP style, you decide to instead make it a member of your "root" class, then pass it around to all the objects that need it. You go to bed at night knowing that your CS225 teacher won't yell at you for using a global object, but deep in that niggling contrary part of your brain, you know that the object merry-go-round you've created isn't very clean and it'll be a pain to maintain. But it works.

Then JavaScript's asynchronous nature throws a wrench in the works. I could make all the API functions take success/failure callbacks, but I'd really like to use Enyo's slick event system. Many separate objects in the application would like to get events from the API, but there's only one API object. Making it global or passing it around doesn't help, either, because Enyo 2 does not currently expose a way to add event handlers at runtime (which is honestly pretty silly).

Well, the first thing I came up with was and elaborate event routing system. The object bubbles a service request event, which reaches the main object, which passes the request on to the API object. The API object bubbles the response, which reaches the main object, which is waterfalled down and eventually makes it back to the requesting object. Beyond the obvious inefficiencies, it becomes a hot potato nightmare of event passing. You need four functions in the main class just to route events, plus at least three event types! For one request! There has to be a better way.

The Middle Path

The solution I came up is the judicious use of static class data. Static class data doesn't get much respect, since it's pretty much the better dressed cousin of global data. But it's there because sometimes it makes sense. And here it very much makes sense.

So what you do is you put all the data that needs to be global in a statics section of your API object. The rest of your API is regular instance methods and data. Then you create an instance of the API object wherever you need it. Each instance has its own event handling, but the shared data is consistent across the application. Here's an example skeleton API class that shows what I'm talking about.

enyo.kind({
    name: "API",
    kind: "Component",
    statics: [
        sessionId: 0
    ],  
    getThing: function() {
        API.sessionID++;

        // This is typically asychronous, but because of event handling,
        // the result is the same either way.
        var response = makeRequest(API.sessionID);

        this.bubble('onThing', {thing: response});
    }
});

Note that the static data is accessed by using the kind name instead of this. Static data doesn't live in your instance, it lives in the global kind object (which is very much like a constructor function in the classical JS object system). Then, in some object elsewhere, you add the API object and use it.

enyo.kind({
    name: "Application",
    kind: "Control",
    components: [
        {kind: "Button", content: "Get Thing", onclick: "getThingClick"},
        {name: "api", kind: "API", onThing: "processThing"}
    ],
    getThingClick: function() {
        this.$.api.getThing();
    },
    processThing: function(inSender, inEvent) {
        // We now have our thing in inEvent.thing
    }
});

Which is pretty darn clean, at least from the API user's perspective. Hopefully it doesn't keep anyone up at night. And in the case of web programming, you already have global state like cookies or the window object, so you're damned from the start. I hope this was enlightening for someone. :)

Beatrice Shepard, Galactic Badass

Fri, 13 Apr 2012 04:05:32 -0500

You may know some stories surrounding Commander Shepard. But how well do you really know the legendary Commander? You probably think her name is John or Jane, but you're wrong. Allow me to introduce to you...

Beatrice Shepard.

Beatrice Shepard fought off the Reapers, but she wasn't happy about it. She'd just as soon stay out of it if it didn't mean the end of all civilization. Here are some more facts you probably didn't know about Beatrice Shepard:

Beatrice Shepard has a bumper sticker on the Normandy that says "Guns don't kill Geth. I kill Geth."
Salarian scientists have calculated the number of fucks Beatrice Shepard gives. That number is precisely zero.
Beatrice Shepard once killed a Krogan just to watch him die... twice.
Sha'ira has to book a visit with Beatrice Shepard months in advance.
Beatrice Shepard can drive the Mako up any slope.
Before killing Saren in the Battle of the Citadel, Beatrice Shepard made him cry and beg for his mother. Then she called him a little crybaby bitch.

Ain't nobody fucks with Beatrice Shepard. Nobody.

Forza 4 Pals: Fugly Ford Ka

Fri, 23 Mar 2012 03:54:22 -0500

When I told Erickson about my superpowered Datsun 510, he immediately thought about doing the same thing to the Ford Pinto. The Pinto has the lowest Performance Index in the game at a measly 100. Unfortunately, the Pinto is a DLC car, so he got the next best thing: the Ford Ka. It also shares the pitiful 100 PI rating, and like the 510, it can be tuned through the roof.

After heavy tuning, Erickson gave it a paint job that I can only describe as "cringeworthy". It's like the car was the bukakke recipient at a pastel teletubby orgy. Pink, purple, green, blue, and a splatter of reddish brown make a patchwork horror of light and color that is somehow made even more ridiculous by the red tow-hook tongue hanging out of the grille. When I asked him what possessed him to make such a design, he stated rather matter-of-factly, "Art designed to be unattractive like this is it's own calling."

Under the hood is a bored-out and twin-turbo'd 2.8L Ford Focus engine good for 531HP. All that power gets to the ground through an all-wheel-drive system ripped out of the Escort Cosworth. At just 2226 lbs, it gets off the line like a jackrabbit. And for having such a short wheelbase, the Ka is surprisingly pinned down. While there's always a little drama in such a highly strung car, the Ka is pretty much just point and shoot. The light weight and stiff suspension will get you in trouble though, if you're not careful.

Pronounced rumble strips tend to act like ramps, making the Ka fly off of them like the shiny chrome orb in a pinball machine. The edge between a perfect corner and screaming while you tumble end-over-end is a pretty thin one. In one race around the Nürburgring, Erickson managed to land it on his roof. I kindly went back to nudge him back on his wheels, but the car was pretty much shot at that point. Great fun, though. :)

Next up, we have a Volkswagen Rabbit GTI I call "Hot Dog" (Did I say it was a Golf? Same difference), and Alex bit the DLC bullet to put the Ford Pinto through its paces with explosive results! Don't touch that dial!

Forza 4 Pals: The Green Machine

Wed, 21 Mar 2012 05:18:59 -0500

Forza has always had a really good car modification system. In particular, they enable a range of engine and drivetrain swaps that allows for some truly spectacular creations. I've talked about my RWD CRX before. My friends and I at the Dominion of Awesome have been busy making our own little Frankensteins: the F-class supercar.

For the uninitiated, F-class is the lowest class in Forza. It's where you find such great cars as the Toyota Aygo or the Chevrolet Spark. Cars so unremarkable they don't even sell them in America. So I thought, "I wonder how far you could increase the performance on these? Could I get them into A class? Or beyond?"

The answer is yes. Very yes.

My first experiement was the Datsun 510. The 510 was a classic small two-box sedan in the late 60's and early 70's. It actually has a fair amount of racing history, so it shouldn't be too hard to soup it up. And it wasn't. Behold, the Green Machine.

The Green Machine sports a Skyline GT-R AWD drivetrain coupled to a SR20DET out of the S15 Silvia. This puts it well into the R3 class with over 700HP. Or, with a VQ35DE from the 350Z and a honking huge turbo, it puts out 767HP, getting it just barely into the R2 class. Tire smoke is the name of the game, and the Green Machine can play all day.

With a stab of the accelerator, the back end comes out and the Green machine will execute beautiful four wheel drifts. You can drive it fast or drive it sideways. It's an easy choice for me. :)

Stay tuned for more. Later I'll be showing you the rest of the F-class supercars in the Dominion of Awesome's stable. Next up, we'll have a pink and purple Ford Ka, then later a VW Golf GTI that wants to be a hot dog, and a Ford Pinto that is "The Bomb".

Super Productive Weekend!

Tue, 13 Mar 2012 04:40:02 -0500

Alex went up to Chicago this weekend, leaving me to my own devices. Oh no, what do I do!?

I dunno, how about EVERYTHING?

I...

watched four episodes of Parks and Recreation, and three episodes of My Little Pony: Friendship is Magic, and The Big Lebowski;
[And you wouldn't think there's any overlap between those last two, but there it is . If you look closely earlier in the episode, you can spot an equine Jesus, as well. My Little Pony: the best kids' show for adults.]
made a new Saturday Night Mix;
created a new Hack, Sliding Text;
completed half of the League of Legends (lol) season in Forza 4;
pretty much completed my Enyo 2 rewrite of WCDS;
and did a load of laundry (I am more proud of this than I should be).

I think I've actually been starved for some "me time", so it was good to catch up with myself. The only downer is that I missed this year's Engineering Open House. :[

Now if you'll excuse me, I'm going to go for a drive because it's beautiful out.

(M)ass Effect

Sat, 10 Mar 2012 05:06:55 -0600

I went out to my parents' for some Swedish meatballs and games. I didn't want to pass up the opportunity to play Forza 4 in HD, so I packed up the game and threw the save up on XBox Live's cloud storage. That worked fine, but my parents' internet is so poor that it couldn't resync the save file to the Internet. Now that I'm home, I can't play my save because it hasn't synced. I'm probably going to have to go back to my parents' house and rescue the data with a USB drive.

But that's OK...

Because when I went home to my parents', I picked up a couple of other games I can play: Armored Core: for answer, and Mass Effect 2. AC4 is my brother's game, and ME2 was a gift from Nancy, who had a spare copy because she lent it out and didn't want to wait for it to be returned. I was just going to start there, but I'd played the ME3 demo and was so impressed with it that I bought the first Mass Effect so I can start from the beginning.

While I was playing, I thought... "There has to be a parody called Ass Effect. There just has to be." And, of course, there is. I'm sure if you tried just a little harder than I did, you could find something pornographic.

The game itself is excellent, but I'm sure I don't need to tell you that. If you haven't played it in the last five years, you probably don't care. Just go play it.

And speaking of videogames and sci-fi, Quantic Dream just released another stunning tech demo entitled Kara. It's only seven minutes long, but it's probably one of the best sci-fi short stories I've ever experienced — it gives me chills every time I watch it. If they make a game out of this concept (like they did with the Heavy Rain: The Casting), I want to play it. Badly.

A "New" Idea

Tue, 28 Feb 2012 05:48:08 -0600

I just had the most wonderful idea for a simple UNIXy notification system. Back to basics — the simplest way of storing a list of items is a directory of files. So the events are actually text files, probably organized with some metadata about the notification's origin, possible actions, etc. Then you have a program that notifies you when new files are added, and one to let you read and delete them, and you're golden.

But you don't have to stop there. You could create a daemon that can accept notifications over the network and store them in your notification directory. Then you can get notifications from other machines like your phone or even a web service.

...

Oh dear, it seems I've reinvented the UNIX mail system. :-/

Gaming on the Other Side

Mon, 27 Feb 2012 04:19:14 -0600

So I recently purchased an Xbox 360. I'd been eyeing one since Forza 4 came out. I can't exactly cite anything about Forza 4 that makes it superior to GT5, but it is still a very solid racing game. At nearly the same time, my friends Alex and Erickson got 360s, so we've been occasionally playing together. It's nice, but I can't say I really like the 360. I don't really like the PS3, either. The purchase was more of a matter of peer pressure and weighing which choice was least terrible.

I've played on both the 360 and the PS3, and IMNSHO, they're both flawed. They're both game systems with services attached. You can watch Netflix and Youtube. Each has an online game store, each has multiplayer services, and each have compelling console exclusives. That's cool, but it's not really enough for me. I've long been a member of the Glorious PC Gaming Master Race , and the tradeoffs made on both the 360 and the PS3 seem arbitrary and frustrating. The 360 is trying so desperately not to be a PC even though Microsoft clearly could make it feature-equivalent, and the PS3 is so desperately trying to be a PC but Sony won't commit because they're afraid of PC-style piracy (and what they do have is rather poorly implemented). So, in a competition for which system is the best at providing features I want, they both lose.

The real crux of the decision is the fact that while both Microsoft and Sony are providing a frustratingly locked-down consumer-only system, Microsoft is at least competent enough to not have their online service wholesale cracked into and user information stolen (but it seems that something is rotten in Redmond). Sony clearly does not give a shit about their users.

The Forza/GT comparison is also interesting. I've spent considerable time playing both now, and I'd like to state for the record that both series are absolutely wonderful. In my mind, there's not really a competition between them. If you're really a car nut, you'd be silly not to play both. That's usually impractical, though, so you should just get whichever one is on your system, because you're going to be happy either way. Which is not to say they don't have their differences. From outside the automotive simulation genre, they look like near perfect copies, but like any finely crafted product, the important differences are always in the details.

Forza's focus is pretty strictly on racing. The breadth of events and types has grown over the years, but Forza's bread and butter is still the circuit race. Forza 4 has only strengthened this position. The original Forza had night tracks, but Forza 2 lost them. Forza 3 held on to the New York City circuit, but it too has disappeared in Forza 4. With only a few exceptions, all of Forza 4's tracks are racing circuits. And they're all daytime courses in dry conditions -- there's no nighttime races, nor any races in rain, snow, or off-road. Forza also has a very detailed focus on car modification. Forza allows extensive and detailed changes, as well as engine swaps, aspiration conversions, and even drivetrain swaps. Car customization goes even further with paint and decals to change the look of your car.

Gran Turismo, on the other hand, is all about the experience of driving. The cars look slightly better than Forza, and the environments look absolutely gorgeous. The course list in GT5 covers city courses, permanent circuits, and off-road venues. I personally think the track design for fictional courses in the GT series is superior to Forza. Many tracks support not only day/night, but also dynamic weather and daylight transitions. One particular challenge has you racing a rally course as dusk turns to night. As you're driving, the sky lights up with fireworks all around you. It's just a fantastic experience. The downside of GT is the limited amount of fully-modeled "premium" cars, which are only visually modifiable with paint colors you've unlocked, plus rims and wings. The performance modifications are rather generic and limited. Also, compared to Forza 3 and 4's heavily directed career mode, GT feels very open-ended, which can be frustrating when you're trying to find the right combination of car and performance tuning to go race. But despite all that, it's just amazing when it comes together.

So you see, they're both very different and both provide a worthwhile experience. I'm currently loving the perverse and twisted ways you can modify cars in Forza (ask me about the Datsun 510-R). Do I miss GT? Sure. But I do have GT1-4 that I can play on my PS2, and that is still a whole lot of game. I'll get around to it eventually, probably after Sony decides not to make the PS4.

Archives!

Sat, 25 Feb 2012 16:57:03 -0600

As promised in the previous post, I've made a new archives page which you can find in the navigation above (or to the side, or wherever I've put it now). It's organized by year, month, and day going back to 2003. Now you can easily browse all my cringeworthy emo bullshit from college! (Oh God Why...) I've also simplified the page navigation at the bottom so it's not a huge list of page numbers. Just next and previous now. Simple.

Aaaaaand we're back

Fri, 24 Feb 2012 04:16:18 -0600

I've been away from my blog for some time, and that just won't do. I could make excuses and say that I've been busy with work, or that I had a temporary lapse of sanity, but the fact of the matter is, I've just been lazy. I've become stuck in a rut, and getting back into the habit of writing is part of my N-step plan to be more awesome. Or to put a bit finer point on it, I caught up with reading Nancy's blog, and she's quite frankly kicking my ass.

If you're not staring directly into the jagged maw of my blog, I encourage you to pay it a visit. I've created a whole new style with fancy serifed webfonts and tastefully minimal imagery from Alice in Wonderland. I think it's a better fit with the literary style of the blog. The titles are a fun rough font called Handserif, and the main text is Alegreya.

Do you remember how I wrote a JavaScript shim to force the handheld media type for small screens? I'm happy to say that I've heaved it in favor of media queries, which does exactly the same thing faster and easier. I've even used it to add a couple of easter eggs to the style. :)

In addition to changing the style, I've changed the date/time format to be more fuzzy and human. I think that's the part I'm most proud of out of all of it. Based on feedback from Erickson (who is working on a redesign of his own), I'll also be cleaning up the page flipper down at the bottom and creating a proper archives browser.

That's all for now, I've got to get some sleep.

A Cheer for the Juicemakers

Wed, 11 Jan 2012 05:29:12 -0600

Most people, when they go shopping, arrive at the juice aisle and think, "Wow, there sure are a lot of kinds of juice to choose from!" They ponder the available selections, pick one, and go on their way.

Other people, perhaps stranger or more adventurous folks, arrive at the juice aisle and think, "Wow, look at all the juice that isn't here!" They ponder combinations of juices yet undreamt. They ponder the fruits of far away places, and what their juices would be like. They ponder fruits unimagined by man, lying in wait on distant worlds and in the minds of similarly curious botanists. They might grab a few bottles and maybe head back to the produce section, wild-eyed and curious.

So here's to the artists, the explorers, the creators, and the dreamers. Here's to everyone who makes the world a more interesting place to live (and drink juice) in. :)

Nokia E6: Day 2

Mon, 14 Nov 2011 12:03:01 -0600

Nope, fuck it. I don't like this. Back to the Pixi.

It's not that the E6 is a bad phone. It's really not. It's plenty capable, it just doesn't fit the way I do things. Over the past few days, I've realized I have two distinct use cases for a phone:

When in my home area, I rely heavily on messaging and searching websites like Wikipedia and IMDB.
When traveling, I rely heavily on mapping, phone calls, and some messaging/web searching.

The Pixi is really good at case 1, and the E6 is really good at case 2. But I don't spend the same amount of time in each case. I'm in case 1 waaaaay more often than case 2. So if we're optimizing for the common case (and as a computer scientist, I'm duty bound to), it just doesn't make sense to keep the E6. WebOS is just waaaay more streamlined for those everyday communication and search tasks. Even with the performance penalty, it's probably still faster at getting things done.

The E6 is also not as fast or as battery efficient as I'd hoped. Symbian is a much lighter system than webOS, and yet the E6 sat and chugged on some simple tasks. There was a noticeable redraw delay for some things like the mail widget or the conversation display, and Qt apps took their sweet time loading. The Pixi and the E6 were nearly matched in performance (806MHz vs 680MHz ARM11 and 256MB of RAM), but the E6 still seemed like it was struggling. I even ran out of RAM once. Either Palm really did some magic getting Linux down to Pixi size, or Nokia really doesn't know what they're doing with Symbian. It's hard to say which is less likely.

And the way Symbian multitasks is just awkward compared to the fluidity with which webOS manages applications. Symbian^3 is a good example of how UX decisions are made based on the inertia of past successes. Palm moved past their 90's success and made webOS. Nokia is only just now doing the same by licensing Windows Phone.

I'm furthermore coming to realize that the sins of Android — inconsistent UI, platform fragmentation, and unintuitive multitasking — were invented by Symbian S60. And while both platforms are moving forward, they are still living up to the expectations set by smartphones a decade ago. That's not a world I want to live in.

So I'm sticking with Palm for now, even though they are now twice dead. I'm holding out hope that someone will make a worthy successor someday. Right now, there isn't one.

Nokia E6: Day 1

Sat, 12 Nov 2011 02:41:22 -0600

My shiny new E6 arrived yesterday, and I've been having a lot of fun getting used to it. Wait, did I say fun? That's not the right word. What's the word I'm thinking of... hmm. Oh, yes. That's it. "Trouble". I've been having a lot of trouble getting used to it. You know those dreams where you wake up in an unfamiliar place and you're trying to leave, but none of the doors lead to the outside and you can't find anything to break the windows? It's kind of like that. (The psychoanalyst line forms to the right...) Which is not to say that it's all bad, but whew, is it different.

First off, the obvious: The hardware is brilliant and the call quality is excellent. The glass and stainless steel case feels solid and weighty. It's likely that if I hurled it at someone, it would actually hurt them. That's important to me. The 8MP camera is good for a phone camera — it does the cool stuff like face tracking and 720p video. A plethora of buttons means that functions are always at your fingertips. In addition to the qwerty keyboard, you have call, end, home, mail, calendar, contacts, volume, record, directional, select, and power buttons. One really cool innovation is the sliding lock key. To unlock the phone, just slide it down. Slide again to lock. And here's a really neat trick: hold the slider down to light up the flash LEDs as a flashlight. Stuff like this shows that Nokia put a lot of thought into how people use their phone.

There are a few more cool party tricks, as well. The phone comes with an app called Vlingo that does speech recognition to do basic tasks like sending messages and searching the web. Just hold down the record button, talk, and it does its thing. The phone will also do AV-out throught the headphone jack and USB-OTG so you can plug USB devices into the phone.

Symbian Anna adds some modern features on top of the classic Symbian experience. You get several homescreens with widgets, which feels a lot like Android. There's an app switcher that shows thumbnails that feels a bit like webOS. The interface is better laid out for touch, and the apps integrate with social networking services like Facebook and Twitter. It's still Symbian, though, which means the smartphone experience is pretty damn oldschool.

This becomes painfully clear at times because the E6 has a brilliant 640x480 LCD screen (that's half of an iPhone 4 screen). A lot of software (even some of the stuff that's built-in) still assumes more modest resolutions, so reading things often becomes a squint-fest. And using S60 or J2ME apps can be an exercise in frustration because they were designed for older phones with a 12-key keypad. It's a little absurd when I have to hit an options soft-key to pop up a list of actions and then select Send when I have a perfectly good Enter key.

And then there's Symbian itself. I really expected it to be a little snappier coming from webOS, but it is at times pretty slow. Sometimes it'll just stop responding for a bit (typically after installing a new application). The messaging app has a threaded view, but it's a bit awkward to use — Enter inserts a newline, and the send button is way up at the top of the screen. Starting a conversation is three clicks at best. The applications menu isn't searchable, unless you use the Search app or widget, which works but isn't configurable. There are a hundred tiny little annoyances, but the worst part is that I can't really tinker with the insides and fix them.

Some of the software is really good, though. Opera Mobile is probably the best mobile browser out there. The video player is the only one I've seen that supports MKVs with subtitles. And Ovi Maps is probably the best mapping application ever made. But those are a few gems in an otherwise barren landscape. If the webOS App Catalog seems small, the Ovi Store is kind of a ghost town. Angry Birds, Snake, a handful of apps, and several hundred themes. Of course, there's a large library of old S60 apps, but I've already explained the problem with that idea. :-/

And then there's mail. I set up my IMAP account the first time unsecured because I hadn't yet installed the Dreamhost NDN CA certificate. I set the fetch frequency to "soonest", which ironically failed to fetch anything at all. After converting the NDN CA cert from PEM format to DER, I got it installed and set up my email account again with encryption. Mysteriously, "soonest" was gone and my best option was "every 5 minutes". I guess Nokia doesn't believe in IMAP IDLE. At least I'm getting mail now. I've also tried to get Windows Live synced via Exchange ActiveSync, but all I managed to do was nuke my address book (restored from VCF with no issues, thankfully).

Battery life is also not quite as good as I had expected. After a typical day's use I'm down to 42%. I'm beginning to realize now how well optimized the Pixi is; similar use would see the Pixi at about 20-30% by now. Considering that the E6 has 15% more battery capacity, it's not doing a whole lot better. I guess smartphones are still smartphones. "If you use it, you lose it."

So... not looking so good right now. Amazon gives me 30 days to return it, and right now, I'm feeling like that's a likely outcome. We'll see how I feel about it after a week or so.

Mobile-Go-Round

Wed, 09 Nov 2011 03:11:22 -0600

Lately I've been through a lot of phones. Well, only three, really, but that's more than anyone should go through in a month. Let's rewind.

I was doing some remote terminal work on my Palm Pixi, and a long string of output bogged it down. I sat it aside, and had dinner. I came back to it later completely locked up, and after a reboot, I got a deluge of messages from a failed machine at work. "No," I thought, "This cannot stand. I need a dependable phone for work."

So I thought deeply about that for a while, then disregarded those thoughts and bought an HP Veer.

The Veer was a spiritual successor to the Pixi, but it didn't quite fill the same square. Where the Pixi was a fully featured but slow candybar, the Veer was a tiny hobbled slider. Most of the reviews for the Veer kept saying "It's too small!" but that wasn't really the problem. A small smartphone is a great idea (as evidenced by the Pixi), but the Veer was a victim of excessive compromise to achieve that ideal.

For some reason, Palm decided that a slider was superior to the candybar. The slider, unfortunately, adds weight and bulk inside the case. Folded up, the Veer is shorter than the Pixi, but it's thicker and heavier. Unfolded, it's practically the same size. WebOS devices are power hungry, so they wedged as much battery as they could in the rest of the case — and this meant it was non-removable. Because of the lack of space inside the case, they ditched the headphone jack and USB port, instead connecting it through a magnetic jack reminiscent of the Nokia pop-port. And that port was really the misfeature that killed it. In order to listen to music, you had to keep around a dongle. Ditto for USB and wired charging. And that means you have two more things to lose. What do you think the odds are of finding a Veer USB cable if you forget yours at home? Slim-to-fucking-nil. So that just wasn't going to work for me.

(As an aside, I gave the Veer to my brother, and he loves it.)

At this point, Alex scrounged up the old Pre 2 that we had worked with on a mobile game for EOH. And that worked pretty well for a while even though the keyboard was frustratingly cramped. And then I dropped it on cobblestones and fried the LCD display. So I bought a replacement on eBay. And that one worked pretty well for a couple of days until I realized it was failing to notify me of new messages. :-/

So we're back at the beginning now. I've switched back to the Pixi, which is actually quite a relief after all of that. I really do like the Pixi. It's a brilliant little phone whose only flaw is that it's slower than Congress passing a bill to raise taxes on the rich. I'd still like something a little more reliable, too.

So I'm looking at Nokia again, because if anyone can make a phone that never fails, it's Nokia. Not that they always do, mind you, but they have. My first phone was a Nokia 6010. It never needed to be rebooted, lasted a week on a charge, and had excellent sound and signal quality. I've ordered an E6-00 to try out, and I'm hopeful that it'll be not terrible enough to work for me. Flawed though it is, webOS has unparalleled (and often imitated) UX design. It's going to be hard to give that up. On the other hand, not having to charge the phone every day is nice, too. And Symbian^3 is going to get updates until 2016. The latest release, Symbian Belle, is coming soon for the E6, and adds a proper notification system. So maybe it won't be that bad.

We'll see in a couple of days when it arrives. :)

The Garfleburgers of Spalagnatz IV

Thu, 25 Aug 2011 20:21:13 -0500

"Do you remember the garfleburgers of Spalagnatz IV? No, I guess you probably don't. Even nowadays putting a brain in a tin can is a tricky procedure, and it was downright dangerous when you were transcribed. I'm sure a lot of good memories got lost then, but it's not like we had much of a choice. But don't worry, I'm here to help recover some of those memories.

"Anyway, the garfleburgers... You begged mom to let you go to Spalagnatz IV for spring break, and she would only let you go if I came along. I wasn't too happy about having to play chaperone, but I was glad to get out of the house. So that July you and I hopped a spaceliner to Spalagnatz IV where we found the garfleburgers... Well, I should back up a bit.

"Spalagnatz IV was a natural paradise planet in the Hyperion cluster. It orbits a yellow star much like the sun, but it burned a little brighter, so the native plants were blue-green. Humans immediately saw its large tropical zone as an opportunity and turned it into the biggest beach party in the universe.

"After checking in at the hotel, you met this guy, his name was Venutias. Half Beloran, I think. He was also on spring break, and had been to Spalagnatz IV a couple of times before, so he offered to show you around. I, of course, didn't trust him one bit, so I made a point of it by tagging along.

"We went to the beach which was completely crowded despite there being several thousand miles of it. Their sand is pink... something to do with extra iron in the soil or something. We swam and had a good time. Turns out Venutias was an alright guy. Some stellahead jock tripped over our towel and then started giving you crap for it. Venutias told him in no uncertain terms to get lost, and the jock left without a fight.

"Anyway, we had dinner at this little burger shack he knew about which had the 'best garfleburgers on the planet.' A garfle was apparently a native animal. Seemed kind of touristy. Their idea of a hamburger was pretty strange, too. Burger, chili sauce, onion, green pepper, marshmallow creme, and cream cheese in a small pie shell. Frickin' weird. It was alright, though. You could barely taste the garfle over all the toppings, but I guess that was the point. I looked it up the other day. A garfle is a small scavenger animal, like a squirrel. Apparently they run rampant all over Spalagnatz IV, and selling garfleburgers to tourists is just one of the ways they keep the population under control.

"By the time we left, you definitely had a crush on Venutias. But like most interstellar romances, it was just not meant to happen. We went back to Earth and he went home to Balora, and we never saw him again. I suppose it was for the best. After you died and they translated your mind to digital, there wasn't much left for you in the physical world. Maybe some day I'll get to see what it's like in there.

"Anyway, I have to get back to work. I'll see you later, sis. I love you."

Like rats boarding a sinking ship

Wed, 24 Aug 2011 03:09:27 -0500

After HP gave up on webOS devices, they incited a bit of a panic. The announcement was so abrupt that webOS users everywhere have been recovering from whiplash and wondering where to go next. HP says they're not abandoning the platform, but at this point, I don't think anyone's willing to believe them. Even the faithful are helpfully providing exit options for their flock. By all accounts, webOS is a sinking ship.

But it is the strangest sinking ship you've ever seen.

HP slashed the prices on the Touchpad to $100/$150 to clear out inventory, resulting in it completely selling out last Sunday. Best Buy's 250K units they couldn't sell? Gone. My good friend Alex said he was one of only a couple of people returning his, while there was a line out the door for people showing up to buy. Overnight, the webOS community grew by likely 300,000 users, with more on the way. And the old guard is welcoming them with open arms.

This "accidental userbase" has caused a sharp spike in webOS interest. PreCentral was having trouble staying up under the load, and apparently app sales are "Way up." HP wanted to be #2 after the iPad, and it looks like they might succeed at this rate. And all they had to do was kill the brand and lose $200 on every unit sold. This enthusiasm will wane, of course, since the Touchpad has no future. But where HP has given up, homebrewers and hackers are likely to keep the platform going for some time.

The software of webOS has always been a little... quirky, and the hardware hasn't always been up to snuff. But the community behind webOS has always been the most solid part of the platform. Emboldened by the fire sale gains, some are banding together to help save webOS (for whatever that's worth). I mentioned PreCentral's welcome above, and webOSroundup has a pretty good introduction to where to look for help from the community. WebOS fans have been through hell and just got shot in the back for their trouble, so they're more than willing to help someone out if they're struggling. As long as those die-hards are still there, then webOS isn't truly dead.

So here's to webOS's meteoric rise to the bottom!

Oh, look, just what I always wanted!

Sat, 20 Aug 2011 03:26:35 -0500

I'm sure by now you've heard the death knell — HP is quitting the webOS device business. Where that leaves the software business is anyone's guess right now. In fact, nearly everyone has been guessing about what's going to happen. Apparently not AT&T or even the webOS GBU (nee Palm) knew that this decision was being made. We do know one thing from this, though: this whole thing is being handled extremely poorly.

So I'm sitting here, typing this on a now defunct device, reflecting on the whole thing. Yesterday was mostly going through the six stages of grief:

Denial - Nigga what?
Anger - Why the fuck would they do this a month and a half after the launch!?
Bargaining - It's OK, the homebrew community will pick up the slack.
Depression - Now I'll never get to sell the apps I've been working on...
Acceptance - You know what? My Touchpad still works just as well as it did yesterday. Everything will be fine.
Wry humor - Hmm, I've lost nearly $500 in virtual money playing Vegas Klondike solitaire. That's sort of like if I'd bought a Touchpad when it was new. Oh wait. I did.

So it may be the end of the webOS world, but you know what? I feel fine. I took a step back and looked at my technological life and realized that nearly everything I use is obsolete or discontinued. I absolutely thrive in the deadpools of consumer progress. I am like a Plecostomus, sucking up the detritus of yesterday's products and turning it into something I can use and grow with. To wit:

My work laptop is a ten year old IBM ThinkPad T23. Next to it sits a homebrew AM2 Athlon PC, hooked up to a VGA-only 1280x1024 LCD screen that I keep around because I like its 5:4 aspect ratio. My keyboard is a Model M that's older than both of my brothers (which, for those of you not counting, is 23 years).
My newest game console is a PS2, hooked up to a CRT TV through a mechanical switchbox that shares the TV with a Sony SMP-N100 media player.
My media server is a dual Socket 940 Opteron server, which displays its console via a 20 year old DEC VT420 (for which I fabricated my own MMJ-DB9 adapter). The drives are hooked up via a PCI SATA adapter because the motherboard has neither PCIe nor SATA onboard.
My car is a 1988 Honda CRX with 206,000 miles on it that starts every time and runs like clockwork.

So really, I just got what I always wanted: A tablet that works with me, is powerful and hackable, and is now obsolete. All is right with the world. :)

Web Workers: Not quite ready for prime-time

Thu, 11 Aug 2011 15:43:01 -0500

One of the near-future browser enhancements I'm pretty excited about is Web Workers. Web Workers are a kind of heavyweight concurrency system, where you create separate worker threads and then pass messages between them. It's not the cleanest or most transparent concurrency model, but it works pretty well in the JavaScript world, where multithreading doesn't exist.

A web worker is basically a separate JS context with a few helper functions and a message passing interface to your main browser thread. A Worker can proceed without interrupting the UI thread, enabling all kinds of things you'd normally do in a timer loop. Typically this speeds things up significantly because you're not stuck waiting for UI to render or the timer to re-fire. I recently modified Cryptobox to use web workers, and the speedup is pretty enormous.

But...

The Web Workers standard is currently a draft, and browser support is spotty. In particular, IE9 doesn't support it (not that I can blame them). In Opera, workers run in the same thread as the browser, meaning you won't get any speedup on multi-core systems. Chrome has the best support right now, followed shortly by Safari with Firefox somewhat further behind. Most mobile browsers don't support it, with the Blackberry Playbook being the notable exception (their browser is probably the most complete mobile browser out there).

Workers come in the standalone variety or a shared version. The shared version allows you to share a worker across multiple windows/tabs, which could allow you to make a single database backend worker with caching, and share that cache across any number of windows that need it. It's a slick idea, but it's less supported than the regular Worker. Firefox doesn't have it, for example.

Debugging support is practically nonexistent. Chrome has a Debug checkbox in its inspector, but it doesn't seem to do anything. Mostly, if any error happens in a Worker that stops its execution, you have to guess at what happened, make changes, and hope it worked. It's rather stone-age. Without proper debugging support, Web Workers are just a cool browser hack that will be used mostly by people who understand the spec (which is probably like three or four people right now).

I look forward to it being finished, but for now, don't bother.

The post-PC world

Sun, 17 Jul 2011 03:57:07 -0500

Two weeks ago I went out and bought a Touchpad. I had been struggling with justification for the purchase, but when it came right down to it, it was really just a "for fun" purchase. The upcoming post-PC world is exciting, and I wanted to play around. So I got one.

The device itself is great. WebOS 3.0 is fast and responsive. Improvements to Just Type allow me to add any search engine I come across. It searches applications, contacts, emails, browser history, calendar appointments, plus applications can add their own plugins to search their content, too. Also, I can start an email, message, facebook post, and more, directly from the card view. It's a system designed to feed information addiction, and it does it extremely well.

Of course it also has the best multitasking and notifications of any mobile system, and it has a small but growing library of games ported from iOS and Android. It is a competent little system. Oh, and it does Flash.

Of course, it does have its share of bugs and disappointments. After you install or remove an app, searching for apps with Just Type breaks. You have to restart before it'll work again. The browser crashes on some sites. The promised Kindle app is missing, as well HP Play and document editing. All of this tells me that the launch was rushed. All of it will be fixed in time.

Some of the things on the horizon are really interesting to me. My prediction about the Touchpad running X has already come true — I have a little debian chroot system set up so I have my Linux workstation inside my ultraportable tablet. I even got a bluetooth keyboard with the expectation of having something that could truly replace my laptop. But that's where PC and post-PC crashed headlong into each other at 75 MPH.

The problem is that the keyboard mappings for webOS are designed strictly for webOS. In any application, I have no control over the Control, Escape, Tab, or any of the function keys. As you can imagine, that makes a Linux workstation pretty unusable. I'm sure the webOS Internals folks are working on that, but it's pretty frustrating to be so close yet so far.

And the keyboard integration in webOS itself is surprisingly poor. The Esc key is now a key that pops up the notifications area. Handy, but once you have that open, the keyboard does nothing to actually delete or activate the notifications. The windows key works like the center button, throwing you back into card view. But once you're there, you can't navigate the cards or activate an application. And Just Type is really handy when you can type quickly, but you can't explore any of the options it gives you without reaching up for the touchscreen. You'd further expect to be able to scroll using the arrow keys in the browser. Nope. I don't even get Ctrl-C/Ctrl-V for copy/paste.

Not that the keyboard is useless, mind you. I'm typing this up on the Touchpad, but that's pretty much all the keyboard is expected to do on this system — type up documents.

So far, it seems like post-PC has taken away more than it's given. But these are all solvable problems, and there are enough nerds out there that they'll get solved one way or another. Probably by Microsoft. Mobile computing is really still in the pre-pubescent "gee whiz" stage where a lot of new ideas are coming out, but very few of them are actually improving our digital lives. Mostly, it's just a lot of exercises in design that would never get accepted in mainstream computing (like hiding apps that are running in the background — didn't we get rid of that in the 80's?). It's a new and fun and exciting time where we get to reinvent the wheel in the name of progress.

But if you're looking to get stuff done, you should probably come back in a few years.