A few days before New Years, I posted how neat it’d be if we had a Ruby Appliance. This, and the mail to the ruby-talk mailing list has resulted in a couple of results already.

For one, we found a name: Ruby Zen, which fits quite well, and is appropriately Web 2.0 without being unintelligible.

For another: rubyzen.org has been registered, and we are feverishly working on getting the website up and some content, too.

We are also working on evaluating Linux distros, with Gentoo, Turnkey Linux, and Ubuntu being hot candidates for the appliance’s operating system.

We’ve also decided to focus on Ruby 1.9.1.

The guys over at gemcutter.org were so kind to provide me with a quick dump of the top 100 hottest gems, so we can pick some great gems to start with.

Unfortunately, this is happening behind closed doors of sorts, since, at the moment, we are using Google Wave which is still closed to the general public. However, if you leave me a comment here, we can organize a handful Wave invites for certain! (I still got 5 or 6 left from the first batch alone.)

So, what else?

Future plans!

In the short term:

• Get a website up for easy contribution (and to move the development process in the public, where it belongs, it’s done by the community for the community, after all)
• Have a prototype VM ready in a couple of days
• Get more contributors. You can help if: You can test a virtual machine, read proposals and comment on them (provide a reality check! Always good!), write a tutorial (maybe for your favorite gem, or Ruby feature)
• Got TikiWiki experience? I’d be glad to hear from you, if you could lend a hand in implementing features (like an issue tracker, or user wiki page).

So, yeah, the Ruby Appliance isn’t forgotten. Considering that this was between the years we did get quite a bit done yet. Thanks to every one (here or on Ruby Talk) who contributed already.

ClothRed is in dire need of help. Your help.

I simply don’t have the time, or will–truth be told–to begin work on ClothRed again. The code’s become foreign to me, way too foreign, and I have to get back into the thick of things, to write any useful developments for ClothRed.

So, what is ClothRed? In theory, it’s an HTML to Textile parser, for example to filter user input, so it goes well with RedCloth (see what I did there? Boy, did I think I was clever).

However, the architecture of this thing is rather stupid, if not braindead, working off of hardcoded Arrays of HTML tags and entities, and #gsub’ing those tags. Embarassing, really.

However, it has a complete set of tests from my TDD (it even passes them, except the one I left off, natch). Still kinda proud of this, since ClothRed was my first project to make use of TDD, and the Unit::Test framework).

If you don’t know where to start: I’d get a rewrite off the ground, using Nokogiri, it seems simple enough (and allows to extract innerHTML, and attributes, and all kinds of neat stuff. Would’ve been nice to have that available when I worked on ClothRed).

The Rakefile needs clean up, too.

So, head on over to http://github.com/CynicalRyan/ClothRed, and take a look if you’d be willing to take up the work from there.

Update: Fixed link.

In this context, an appliance is a ready-to-run virtual machine. No set up to speak of required.

But why? Isn’t it easy to install Ruby wherever you like?

That is very true.

However, the Ruby ecosystem is very *NIX centric. Not everyone has the luxury, or time or ability, to setup and maintain a UNIX-like operating system.

Virtualization and thus appliances turn operating systems into just another kind of program. They reduce the risk of using a different operating system. Further, not everyone using Ruby wants to, or can, dig through C extensions to make them work on their operating system of choice. The hurdles as a Windows user are too high in most cases.

An appliance makes it easier to setup test environments, so they are great for seasoned developers, as well!

You can start with a clean slate, only Ruby, RubyGems, and a compiler tool chain are installed, and you can easily revert to this blank slate at the push of a button. With the different networking tools in today’s VM tools, you can even test network deployment of Rails applications.

So here is my proposal:

To create the best possible Ruby appliance and experience, I want to know which Gems and tools the Ruby community sees as essential to make life as a Rubyist easier.

Submit your ideas, and the Ruby Appliance will benefit and with that, all of the Ruby community.

Speaking of which: Praising “open” and using Macs, makes a hypocrite at best, and an idiot at worst. Use OpenSolaris, *BSD, or Linux if you want to be open in spirit. Or, like me, stop bothering, and use what you are comfortable with, and stop pretending you use it for any other reason than that you are comfortable with it.

Anyway. vim.

After nano, vim is the best editor in the world (once you get used to its idiosyncrasies), making editing code, or plain ol’ text a breeze, and its distinction between editing and normal mode is quite sweet.

But, while using the official (well, as official as open source gets) gVim 7.2 distribution from vim.org, I noticed that it is compiled with -ruby (and -perl, or -python). Neither :ruby nor :rubyf work. Which makes the hack, test, hack, test cycle not smooth at all, since :rubyf % doesn’t work.

Fortunately, fixing this is easy, once you know how:

Install the official gVim 7.2 distribution, and get Wu Yongwei’s gVim build. replace the binariesof  your vim installation with the ones in his gVim 7.2 distribution. Done. This works even with the MinGW Ruby distribution from RubyInstaller.org.

Happy Vimming.

A bit of exposition first: Somebody did a technical presentation at a technical conference. Unfortunately, a few members took offence at the presentation. Not its contents, mind you, but the way the presentation was done. It contained imagery that, to my refined European tastes, is soft-core pornography. Apparently (and I can’t really tell, since I wasn’t there),the publicly availabel slides of the presentation don’t even contain all the oh-so-edgy material, but word has it that the technical oriented part of the presentation contained soft-core pornography, too. To mix things up, apparently. The Rails community is on the cutting edge, after all.

The presentation is a great example of how not to be edgy and how to waste an opportunity in marketing.

But let me define “edgy” first, so that we are on the same page.

Looking at the Urban Dictionary, the term has various meaning. The second one seems to fit the most:

1-pushing the envelope 2- to be way out there to be on the cutting edge or to be edgy

Dictionary.com seems to agree:

3. daringly innovative; on the cutting edge.

So, how was the presentation not edgy?

Well, “sex sells” is a truism. From car ads, to shampoo ads, to razor blade ads, to chewing gum. The advertisement industry thrives on that. you can find it in movies, too. Who doesn’t remember Dr. Manhattan’s schlong from the Watchmen movie? Or the trite sex scene of 90% of non-comedy, non-family values Hollywood movies?

So, tehre we have it: A community that sees itself as edgy, innovative, rule-breaking and “eschewing the rules” is using the most base, most commercially exploited, and least creative technique to gain attention there is. That isn’t edgy. That’s playing it safe. It’s relying on instincts of a (predominantly) male audience: “Look, tits. It must be awesome/cool/mine!” or “It gets me the chicks. I shall have it and get the chicks myself.”

Now, you can certainly play this instinct for irony. The Axe (Lynx in the UK) commercials do that. An old Toyota ad did that. The Rails community didn’t.

So, how is this a marketing failure as well?

This is two fold. For one, nobody is talking about what the technical presentation contained that was technological. Instead, it back-fired to the extreme. And deservedly, if I may say. If you play with fire, you can get burned.

Second, all the porn is actually distracting from the content. It  might have worked as a hook (since a lot of people saw the presentation, it actually did). But it doesn’t work as a theme for a whole presentation. Certainly not for me. A presentation themed around the Art of War was tedious for me, too (give it a try, though). And military history is something I have an interest in.

In short: The presentation is a failure. It is a disgrace to my gender, it is a disgrace to its topic (CouchDB seems to get a lot of buzz, but I doubt I’ll look at it any time soon, since it doesn’t fit my current requirements, and I want to wait until the storm has calmed down at least a bit. Which’ll take a while, I guess), and it is a disgrace to the edgy crowd.

Now, my personal opinion on this, and be warned, I won’t be looking for excuses for the behavior of people (like :

What was the author thinking? I have no idea. He thought it was a good idea, apparently, and ran with it. Unfortunately, he ran the thing to the ground. It’s obvious that we software developers need to work on our people skills. And it seems that Matt took a step back from the whole mess. He believed to be on the safe side, too. He ran it past the obvious candidates to check his presentation. Lesson learned, I hope, and this shouldn’t repeat itself. If it does, I’d take a long hard look at my life choices and values. Because then the problem is with me, not my audience.

So, I won’t dwell on this, especially if the author’s of the links I’ve posted said it better than I ever could.

_why, the lucky stiff, compiled a post with reactions by actual women. It is more than worth your time.

That being said:

What pisses me off most royal, is the attitude some people show (note, this is the general “you”, not the personal one. I have no beef with DHH himself, just with the attitude he and others have).

Quote David Heinemeier Hansson:

You’re bound to upset, offend, or annoy people when you’re not adding heavy layers of social sugarcoating.

Quoth he furthermore:

[Not adding heavy layers of social sugarcoating,I think. - The author] means that it leaks out that I love listening to Howard Stern, that Pulp Fiction is one of my favorite movies, that I laugh out loud at Louis CK’s Bag of Dicks joke, that I whole-fully accept my instinctual attraction to the female body, that I think drugs should be legal, that I really like the word fuck and other gems of profanity, and on and on.

I like Pulp Fiction, too. One of those days, I’ll even see it completely and in one sitting. I like to watch women on the streets as any other male sharing my taste in partners, I curse (sometimes heavily, especially if I am agitated or (feel that) I have been wronged). That doesn’t excuse me from being a human being. From showing respect, and seriousness.

That I curse has an impact on my language and use of language, but that doesn’t mean that I use the word “fuck”, “shit”, “goddamn” as filler.

The very point where you claim to be superior for being an asshole,

I won’t stand there, and say “You are a unique and beautiful snowflake. You have every right to be an ass.” No, sir. I won’t try to be apologetic for your behavior.

If you want to be taken serious, act like an adult.

It’s completely and utterly any one individual’s responsibility to make sure that they get along with a community and society at large. It’s not my problem if I get offended by what you do. It is your problem not to offend me. That doesn’t mean that you should make absolutely sure that what you say and do isn’t controversial. Far from it. But it does mean that you have to show others the respect you want them to show you.

Having invented a technology only goes so far. You gotta work if you want to keep it.

Communication and life are two-way streets.

The rails community some-what values that it is non-professional. That it is anti-enterprise. That’s fine. That shouldn’t mean that offending just for the sake of offending, and then not having the balls to apologize, are condoned, nay encouraged.

Me, I’ll draw my consequences out of this mess. Personal (Do I want to be involved in a community like this? Note, that I am not talking about the Ruby community!), and professional (Do I want to use a technology that the community doesn’t know how to sell except with tits?).

Until then, I stand up and be counted:

I want the Ruby, Rails, open source, and web development communities to be a dignified, respectful, inclusive, and welcoming place. Acts like putting questionable imagery in a conference talk are regrettable and harmful to those aims. We’ve all been witnesses to off-color jokes, misogynistic back channel chatter and unnecessary, trolling comments. I pledge to do better to stand up and call this behavior out when I see it in conferences, online and other public settings. I don’t expect it to go away but I’m not going to tacitly condone it any longer.

Without any shame stolen from Nick Sieger’s blog.

I’ll just add the following:

• This holds true for any community I am part of.
• This holds true for any offense I am witness to.
• Someday, I’ll have the backbone to speak up face to face, too.
• I’ll actively work towards this day.
• Respect, fairness, and openess are requirements to be successful.
• I’ll make mistakes. I want to be called on them.

Thanks for reading.

The article, which is un-surprising good in the technical aspect, claimed that the testing framework is able to process your testing scenario in plain text, from the user’s perspective. Without having looked at Cucumber: This is wrong.

“But wait,” you say, “you haven’t looked at Cucumber.” True. However, I bet you dollars to donoughts, that, just as with RSpec, Shoulda, and any other testing frame work, you’ll have to learn a vocabulary to express your thoughts, so that the tool understands what you want. Just because computers can’t do natural language processing. Yet, anyway.

Let’s stop misleading ourselves, in implying that “plain text” means “natural and intuitive”. It isn’t. If I wouldn’t know that Cucumber is doing Behavior Driven Development, I’d have no idea what “Given a…” meant in this context.

For us humans, text needs context, and that has to be provided somehow. This is even worse with computers: We can derive context from content, computers are too stupid to do that. Accordingly, Cucumber needs you to write the test parser (judging by the most curious look I gave it. It’s probably just fine tuning the actual testing and mock ups). Using Regular Expressions, too (just to add insult to injury )

How about we call “plain text” and similar things “understandable”, instead? After all, while these tools don’t live up to what is implied, they are able to make a key point of (agile) development accessible to the most important stakeholder: The customer, while giving us, the developers, a basic template for sanity checks. This is more than important, it is an absolute necessity for our survival as business entities, and in part even as hobbyists! Cucumber’s BDD tests probably don’t need an understanding of the programming language you happen to use, but abstract this away, since it is, in general, not needed at this stage.

Just remember The Law of Leaky Abstractions

Without Java, I wouldn’t be able to use JRuby.

And neither would I be able to use Warbler to create .war-files for drag and drop deployment.

In the span of 30 minutes (half of which is related to my underspec’d development environment), I was able to deploy a Rails application.

First, you need to setup your Rails application for use with JDBC. In Rails 2.0 it is as easy as this database.yml:

development:
host: localhost
adapter: jdbc
driver: com.mysql.jdbc.Driver
url: jdbc:mysql://localhost:3306/application_db
username:
password:

With the Warbler gem, you can easily create a war file:

jruby -S warble war

To fine-tune your configuration (if Warble’s defaults aren’t as good for you as they could), just run

jruby -S warble config

You can edit the resulting config\warble.rb for some fine tuning (I’ll have to look into it, for example how to tell it to use a specific JRuby version).

Once you are ready to create your .war-file:

jruby -S rake war:standalone:create

Thsi creates a war file inculding the JRuby runtime. Drop into your domain’s autodeploy folder, and wait until Glassfish is done deploying it. Done. You have a working, deployed, and automagically scaling Rails application. No need to herd a pack of Mongrels, futy with mod_proxy, or anything else. Wonderful.

BUT there is one issue you migth have (whcih is unrelated to Ruby, JRuby, or Glassfish):

It is possible that your Rails app throws the following exception:

No :secret given to the #protect_from_forgery call. Set that or use a session store capable of generating its own keys (Cookie Session Store).

Don’t fret. Either use the correct security, or change your app/controllers/application.rb so it looks like this:

protect_from_forgery :secret => ‘a_really_long_pseudo_random_hash_thing’

Simply remove the comment in front of the :secret. Done. Enjoy the bonus you just ensured for yourself, since you avoided at least a day of additional deployment and configuration, and/or learning capistrano.

P.S.: Still working on the comparison of OpenID and CAS for Ruby, so this is a bit of filler content.

OpenID is an open standard that is not vendor controlled. That is, neither Google, nor Microsoft, nor Apple could change the nature of the standard and ‘neglect’ to tell everybody about it.

The aim of OpenID is to provide users with a means to log in at websites without creating an account with a specific site (if you run your own OpenID server, you don’t have to tell anybody your username/password).

After this little overview of OpenID, let’s get into Ruby-OpenID:

Like Ruby-CAS, this package comes in two flavors: A server component, and a client component.

My own OpenID server? Anyone? Bueller? Bueller?

However, compared to Ruby-CAS, the server component is limited. The OpenID server (based on Rails) is an example only, and doesn’t even come with tests to take a look at how it works. A shame, really. So, without this, you’ll have to roll your own solution to this. Since this is a Ruby gem, you can easily create a server and roll with it, using any storage solution you chose. However, the investment on your part is much higher than with Ruby-CAS’ server, which provides a turn-key solution, unless you need something that is very uncommon (like me .

My client has OpenID. He showed me the URL.

The client side is a bit more complex. For login, users have to provide an OpenID enabled URL, from one of the many OpenID providers. Chances are, that you already have an OpenID URL, without knowing it (off the top of my head, Blogger, Yahoo!, LiveJournal, and AOL provide OpenID URLs already)!

With this URL, a web application can authenticate a user. You get redirected to the provider (discovered via the Yadis protocol, to standardize the data protocol. Isn’t interoperability fun?), and have to provide your credentials there, and then you have to approve the application (just once, or permanently), too. Or rather, the application’s URL. And you have to repeat this process for every single account you create someplace else. After approving the URL, you get redirected back to the site that requested your authentication, and you are being logged into the app (or an account is created for you, and then you are logged in, or however this is handled).

This solution is ideal for the internet (where services rarely know about each other), but not so good for an intranet (where services and people know about each other).

Ceterum censeo Carthaginem esse delendam

If you want to create trust, without forcing people to create accounts and maintain yet another set of username/passwords/mock-two-factor-authentication-security-question, OpenID is certainly the way to go. Even to create accounts for your web service’s users.

The big downside is, that proxy-authentication (like with CAS) isn’t possible, or you have to roll your own, somehow.

Also, since OpenID is pretty much roll your own on the server side, other solutions are probably better for you if you want to have SSO for an intranet.

If you want to read more about Ruby-CAS, I wrote an entry about that, too.

Coming soon: Oh my God, what did I get myself into this time? Or: Comparing Ruby-CAS and Ruby-OpenID.

The issue was more that there are only these two options in the first place.

However, I’m going to take a deeper look at these two options. I’ll do this in three articles, focusing on RubyCAS client and server first, OpenID client and server second, and comparing these against each other in the last episode.

Now, without further ado, a look into CAS.

CAS is Yale’s solution to the SSO problem. It provides a client/server architecture, allowing each application to authenticate users against a single server.

Matt Zukowski (his RubyForge profile) implemented the Ruby variants of the Central Authentication Service Protocol (short CAS), both on the server side (RubyCAS server), and the client side (RubyCAS client).

Clientèle dealings

The client simply enables to authenticate against a server implementing the CAS protocol. That’s it. Well, not quite.

Actually, a CAS enabled website hands authentication off to the CAS server login page, which checks the user’s credentials, and redirects back to the requested webpage on successful authentication. The web application verifies that the user has, indeed, logged in, and works as expected.

The benefit of CAS for web-based SSO is, that any CAS-enabled application can use the ticket issued by the CAS server for authentication, as long as the server can read the cookie placed (so, it has to be the same URI that reads the cookie, not necessarily the same server).

Serving the greater good

The server works a bit different, and necessarily so. It takes the user’s credentials, authenticates the user against the configured form of storage, and redirects back to the application requesting the authentication of the user.

For authentication, RubyCAS server brings three pre-configured Authenticators:

• CASServer::Authenticators::LDAP to authenticate against an LDAP directory service, and LDAP’s cousin Active Directory gets its own Authenticator, called.
• Additionally, there is an SQL authenticator CASServer::Authenticators::SQL, which can use any SQL database that ActiveRecord can talk to.
• If none of these fit the bill, you can apparently use CASServer::Authenticators::Base to roll your own authenticator (the RDoc documentation is rather silent on the issue, and I haven’t dug into the source code yet).

Concluding the obvious

As long as you use Ruby, you should be able to use RubyCAS client (you’ll probably have to do some source code hacking if you don’t use ActiveRecord for the RubyCAS server, though).

This should be of a great boon in any organization using the CAS system already. And the wealth of client options provided by the CAS ecosystem should make CAS an easy sell if you are looking for an SSO solution.

Well, this won’t quite work out, since I already have the contract in hand.

However, I’ll write up what I am going to do, what I am doing, and the milestones reached. Well, a software development blog.

So, what’s the project about?

I have to build a web-based Document management system.

Requested Features:

• Single Sign On
• Import documents from a network share
• Storage of metadata (an odd one in this case is, that physical locations have to be recorded, too, in case the government agency sending it cannot deal with electronic documents. Legal requirements are fun like that)
• Fortunately, no detailed tracking for SOX or other such regulations.

What’s coming up

At first, I’ll post progress about gathering requirements, proposals and recommendations of solutions for these requirements that go out to the client (after I’ve sent them, though).

After that, I’ll report my progress with the application: What I did, why I did it, and what the challenges were.

And last but not least, I’ll talk about the deployment of the application, and its maintenance.

So, what are you using?

The web application framework is going to be Ruby on Rails, the database back-end MySQL, the webserver will be Apache of some sort. What’ll serve the Rails pages I don’t know yet. Maybe Glassfish with JRuby, maybe mod_rails, possibly the classic Apache + Pack of Mongrels solution. We’ll see when I get there.

My development OS will be Windows XP together with a Debian VM and a Kubuntu 8.04 installation as primary development OS.

The deployment will be on FreeBSD 5.4 (I know, I can’t influence that, and neither can my client).

The approach I’ll be using, even though I’m just one person, is a simple variant of Agile Development: Sprints, and loads of tests before I write the actual code.