My earliest attempts to counter SQL injection

In 2003, this site was hacked and the content was lost. This is why there are no posts from before 2003, despite my registering the domain and running the site since 2001.

I don’t have anything written down about what happened. The site’s code was probably the very first web application I wrote, likely in 2001. Back then, I’d written dx13’s backend in original ASP, using Javascript (I was writing server-side JS a whole eight years before node.js was even named node, fellow hipsters 😬). It was running on a shared virtual server and backed by a MySQL database. What exactly went wrong is lost to time, but I came across a clue today.

Read More…

Using GitHub Actions to publish this site

Since 2019 this site has been built with Hugo. Until today I used a Makefile target, included as an addendum for historical interest. I decided this morning that I’d switch this over to use GitHub actions and write up the experience.

This post was going to be substantially longer, presumably containing a load of stuff about creating a custom GitHub action that used a customised container with Hugo inside, figuring out how to get the site published to the gh-pages branch, then committing it and pushing it. I thought committing back to a different branch in the repository from within the GitHub Actions runtime might end up being harder than I expected. At any rate, I figured the post would be quite helpful and fancy.

But it turns out that last July GitHub added the ability to use GitHub Actions directly to publish to GitHub pages, bypassing the gh-pages branch completely. There is even a template for using Hugo. Creating a workflow from that template worked first time 👌.

That was quick – and I suggest anyone still using a Makefile target or custom action switch over. It’s a nice system. I can now publish to the site from a Git client on my phone. Should I ever want to.

Read More…

More, Smaller, Things

Reading Matt Gemmell’s Write Less reminded me of a feeling I have:

On social [media], content of any length at all is fine — and indeed the maximum allowed length is often very short, which reinforces the association. So, perniciously, our eager-to-simplify brains have decided that the converse is true for blogs: you can write only longer, weightier stuff.

I wrote something similar myself, way back in 2007:

Sometimes just getting a couple of paragraphs online would be better than writing nothing at all. Short howtos, “I spotted this useful thing” and peeks into other worlds.

Posting quick pointers to pages I’ve found interesting feels like it should happen elsewhere. But I don’t use my Twitter account. Nor do I have a Mastodon or Facebook account. And I have never downloaded TikTok.

It turns out that I don’t have an elsewhere.

Read More…

Gig: Lizzie Esau and George O’Hanlon at The Louisiana

Like coding more, I’d like to go see more live music this year. Just after new year, I poked around gig listings for Bristol and came across The Future Icons Tour feat George O’Hanlon & Lizzie Esau + How Nice. While I’d not heard of any of them before, I enjoyed the music in the videos on the page, listened to a few more tracks on Spotify and convinced a friend to take a punt on the gig with me.

Read More…

First commit to CouchDB, at last

Finally, after 10 years, 146 lines of my own in CouchDB 💪.

I joined Cloudant just over ten years ago, when it was still a startup of thirty. And only now have I made my first PR to CouchDB, the open-source database that undergirds Cloudant’s service. Why so long? Well, I spent those ten years playing my part by building many parts of the service around the database.

But I’ve always harboured a desire to work more on the database. Reflecting over Christmas, I felt that I’d really like to make this year the one where I build up my skills in both Erlang and the database.

Having made this decision, this PR is a nice thing to have gotten done within the first month of 2023. While not groundbreaking, it’s not trivial and so I’m pleased with it for a first effort. The PR improves query processing by shifting some work down to the machines hosting the database shards, reducing cluster network traffic. The only real complexity lies in not breaking things while the cluster is in a mixed-version upgrade state – the query is distributed so can be being processed simultaneously by old-version and new-version nodes. Ensuring that behaviour is always correct as nodes are upgraded at different times across the cluster took a little head-scratching.

My favourite thing about the work is that it lays some groundwork for other improvements in query performance, such as those described in this RFC I’ve written. After that, I’m not yet sure where to look. I’ve been digging into a few deeper bits on database querying which could be interesting. But there are many other places I could usefully contribute.

It’s nice to be writing more challenging code again.

Read More…