Robby on Rails: Tag rails

New Boxcar plans announced!

Robby Russell — Fri, 30 May 2008 14:30:00 -0500

Yesterday we announced our new suite of plans for Rails Boxcar. You can now get started with a pre-configured VPS designed by Rails developers like you for as low as $59/month.

You can check out our new rates here:

http://railsboxcar.com

If you’re at RailsConf, be sure to introduce yourself and ask for details. :-)

Boxcar Conductor plugin moved

Robby Russell — Fri, 23 May 2008 04:23:00 -0500

Update. We’ve moved the Boxcar Conductor plugin for deploying Ruby on Rails applications to a new location on GitHub.

http://github.com/planetargon/boxcar-conductor

You can still submit bugs/feature requests on Lighthouse here:

Boxcar on Lighthouse

Enjoy!

Boxcar on Twitter

Robby Russell — Thu, 22 May 2008 22:00:00 -0500

We’re about to roll out some announcements for Boxcar, our professional VPS hosting solution for Ruby on Rails applications. As we roll out these new updates, we’re going to offer some extra special deals to those who are following us on twitter. :-)

If you want in on the action…

As usual, we’ll be posting some announcements on our blog as well… so be sure to subscribe to our feed.

Boxcar Conductor: Rails deployment made easy

Robby Russell — Tue, 15 Apr 2008 12:16:00 -0500

In a previous post, I showed how we’ve been working on an interactive deployment process for Rails applications to reduce the time it takes to deploy to a Boxcar.

We began to move our Boxcar deployment recipes into it’s own Rails plugin and just made it available on GitHub.

Introducing Boxcar Conductor

The Boxcar Conductor plugin aims to automate the entire process for deploying to your Boxcar. We’re down to just a few simple commands to run to get your application up and running. While mileage may vary with other hosting providers, we did want to open up this work to the community and centralize our work with the community of Boxcar customers who have helped us build and test these tools.

Install Boxcar Conductor

If you’re running on Edge Rails… you can take advantage of the new support for installing plugins in git repositories.


  $ ./script/plugin install git://github.com/planetargon/boxcar-conductor.git

note: If you’re not using edge rails, you can download a tarball and install the plugin manually.

Installing the plugin will add a custom Capfile and config/deploy.rb, which has a few things for you to define based on your Boxcar subscription.

Configure Your Boxcar

Once the plugin is installed, you can run the following task:


  $ cap boxcar:config

This will ask you a few questions about your deployment needs.

Uploaded with plasq’s Skitch!

Which database server will you be using? (along with db user/pass info)
How many mongrels should run in your cluster?

After a few quick multiple choice answers, you’re application is ready to be deployed and you can run an Boxcar-specific deployment task.


  $ cap deploy

We’ve also created a new public project on Lighthouse so that you can submit tickets and ideas to us. With Boxcar, we’re really aiming to remove as many steps from the deployment process that aren’t necessary.

To follow along, visit the project on lighthouse or GitHub.

If you’re interested in learning more about Rails Boxcar, feel free to drop us a line.

Announcing Cobalt and monthly subscriptions for Boxcar

Robby Russell — Mon, 14 Apr 2008 10:24:00 -0500

We’ve been designing and developing a new centralized billing platform over the past few months and late last week, we launched it! Along with this new billing platform, we launched another new application, Cobalt, which is a new account management and support tool for our hosting customers.

Uploaded with plasq’s Skitch!

We’ll be migrating all of our past customers over to this new system in time, but are initially using it for new Boxcar customers.

We’ve been building the new system to use Braintree as our new credit card payment gateway. With this switch, we’re also introducing monthly subscription rates for Boxcar, which means that you can try it out month-to-month now.

Over the next few weeks/months, we’ll be announcing several features to Cobalt that will ease your Rails deployment experience.

I want to thank all those on my team that helped get these new applications up and running.

If you’re looking for professional VPS-based Rails hosting, hop on our train by ordering a Boxcar today for $99/month!

For more information, visit railsboxcar.com or Planet Argon.

Also, be sure to follow Boxcar on twitter.

Managing Required Gems on Rails Projects

Robby Russell — Wed, 26 Mar 2008 22:27:00 -0500

We’re starting a new project and I’m finding myself adding things to the code base that we’ve done in the past… hence the last few posts. As we’re doing this, I’d like to highlight some of the little things that we do on each project to maintain some consistency and in that process reach out to the community for alternative approaches.

I’m intrigued by the vendor everything concept, but we haven’t yet adopted this on any of our projects (yet).

What we have been doing is to maintain a REQUIRED_GEMS file in the root directory of our Rails application.

For example:


$ cat REQUIRED_GEMS

actionmailer
actionpack
actionwebservice
activerecord
activesupport
cgi_multipart_eof_fix
daemons
fastercsv
fastthread
feedtools
gem_plugin
image_science
mongrel
mongrel_cluster
mysql
rails
rake
RedCloth
Ruby-MemCache
soap4r
uuidtools

Everybody on the team (designers/developers) knows to look here to make sure they have everything installed when beginning to work on the application.

This has worked fairly well from project to project but since we’re starting a new project, I’m curious if anybody has some better ways to approach this. Should we look more seriously at the vendor everything approach or are there any alternative approaches?

Managing SEO-friendly HTML Titles with Rails

Robby Russell — Wed, 26 Mar 2008 16:41:00 -0500

I’ve seen this come up a few times in the #rubyonrails IRC channel and figured that I’d post a quick entry for future reference.

Problem: HTML titles

You want to have a clean way to manage the titles on your HTML pages.


  <html>
    <head>
      <title>Robby on Rails &mdash; Article Title Goes Here</title>
    </head>
    <body>
      ...

Possible Solution(s):

Since the <title> tag is usually declared in your layout, you need to be able to dynamically update this information from almost every action in your application.

Here are a few ways that I’ve seen this handled.

Use a instance variable, which would have a default value and you could override it in any controller action
Use the content_for method to manage it.

Let’s take a few minutes to look at these two approaches.

Instance Variable

With the instance variable, you might end up with something like:


  # app/views/layouts/application.html.erb
  <title>Robby on Rails &mdash; <%= @html_title || 'Default text here...' -%></title>

Then in a controller action…


  # app/controllers/articles_controller.rb
  def show
    # ...
    @html_title = @article.title
  end

So, that’s one way to handle it and is probably a more common way.

The `content_for` helper method approach

This solution is very similar (and underneath uses an instance variable).

We’ll use the content_for and a little yield action.


  # app/views/layouts/application.html.erb
  <title>Robby on Rails <%= (html_title = yield :html_title) ? html_title : '&mdash; Default text here...' %></title>

Then we’ll create a helper method.


  # app/helpers/application_helper.rb
  def set_html_title(str="")
    unless str.blank?
      content_for :html_title do
       "&mdash; #{str} " 
      end
    end
  end

Now, instead of defining the HTML <title> value in the controllers, we’ll just toss this into our html.erb files as necessary.


  <% set_html_title(@article.name) -%>
  ... rest of view

..and that’s pretty much it.

Which is the better solution?

This is where we’ll not find a lot of consensus amongst people. I’m a fan of the content_for-based approach and defining the title in views rather than in controller actions. I’m an advocate of skinny controllers and while I’m not a big fan of messy views, I believe that there is less overhead in managing this within the View-world.

I’d love to hear your thoughts on this. Perhaps you have a more eloquent for managing things like this? Do share. :-)

Things (in the Rails world) You Don't Yet Understand

Robby Russell — Tue, 25 Mar 2008 10:12:00 -0500

This is inspired by a recent post by Seth Godin titled, Things you don’t understand, where he shared a list of things that he probably could understand if he put your mind to it, but doesn’t. I decided to post a list of five (5) things in response within the context of Ruby/Rails.

I’m really interested in various things but am really unable to prioritize them high enough to spend the time to understand them.

RSpec User Stories
Using Selenium with RSpec
JQuery (Graeme speaks highly of it)
JSSpec (BDD for Javascript)
Using the Google Charts API with Rails

What about you? What’s your list of things that you’d like to understand more about?

DRY(a): Year After Year

Robby Russell — Mon, 24 Mar 2008 22:05:00 -0500

I’m guilty of it. Many of you are likely guilty of it… and I know that several customers of our Rails Code Audit and Review service are guilty of it.

How many times have you realized (after a few months has passed) that your Copyright date/year on your web site was no longer current?

How many of you had the same problem last year? The year before?

Let me share some advice with you all… DRY (a)!

Don’t Repeat Yourself (again)!

This is really a simple problem to fix but when we’re busy tackling bigger problems… little things like this slip by. Don’t worry, you’re not the only one who was reminded by a colleague three months into the year that you forgot to update this.

On client projects, we have a handful of helpers that we drop into the application. We’re starting to extract more of these into plugins and will be releasing those as time permits. It just happened that I found myself looking at yet-another Rails code base this afternoon that was showing 2007 in the footer. An easily forgivable offense.. but if you’re going to go in there and change it (again), take a moment to do the right thing. ;-)

Our solution at Planet Argon on client projects is to create a basic view helper that renders the current year. This allows us to do the following.


  <div id="footer">
    &copy; Copyright <%= current_year -%>. All Rights Reserved.
  </div>

The helper code looks like:


  # add to application_helper.rb
  module ApplicationHelper
    def current_year
      Time.now.strftime('%Y')
    end
  end

Voila. Not rocket science.. is it?

Guess what? I’m getting really tired of adding this to every Rails project that I touch. So, I bottled this little gem into a new Rails plugin that we’ll just add to future projects.

Introducing Year after Year

This is really the smallest plugin that I could put together (and it includes specs!)

What does it provide you?

YearAfterYear will provide you a helper that will render the current year (dynamically)! That’s right… just add the plugin to your Rails application and you too can enjoy New Years 2009 without having to have a deployment ready with a one line change from 2008 to 2009!

To use.. add the following to any view from within Ruby on Rails.


  <%= current_year -%>

Installation

As I’m using git, you’ll need to grab this and put it into vendor/plugins. That’s it!

You can grab it on GitHub!

http://github.com/robbyrussell/year_after_year/
Bugs / Feature Requests here

Happy New Years (8+ months early)!

Just a friendly reminder to not forget the small stuff… because your visitors will notice! ;-)

Updates…

I got a few requests for this to also provide a range of years for people who like to do: 2005-2007. So this is now provided as well.

year_range(start_year)

Example:


  <%= year_range(2005) %> # => 2005-2008

The Argon Express 2008? It's not too late!

Robby Russell — Wed, 05 Mar 2008 18:39:00 -0600

Picture yourself and your laptop. It’s been over a day and you’re sitting on a train with a group of Rails developers with a view like this over your shoulder.

Hacking and reading on the train.

Enjoying the sceneary of the U.S.A.

Two years ago… a group of us went from Portland to Chicago for RailsConf 2006 on the Argon Express.

I know this is a tad late… but uf you haven’t purchased plane tickets to Portland yet for CabooseConf or RailsConf 2008 and would be interested in catching the train from somewhere the East Coast, email me and we’ll talk. I’m hoping to organize the Argon Express 2008 over next few weeks.

Launch your own RubyURL

Robby Russell — Sat, 01 Mar 2008 18:31:00 -0600

A few weeks ago, I moved RubyURL from subversion to git. During that process, I decided to use my invite to GitHub and have decided to go ahead and open up the source code.

It’s currently a whopping 92 LOC with a 1:2.5 code to spec ratio. (I had a goal to keep is below 100 LOC)

RubyURL on GitHub: http://github.com/robbyrussell/rubyurl
Public Clone URL: git://github.com/robbyrussell/rubyurl.git

Feel free to grab it and help contribute. This has served almost 14 million redirects since August 2007 and is running on a Rails Boxcar.

To grab it with git.. run: git clone git://github.com/robbyrussell/rubyurl.git.

Feel free to submit tickets to the Rubyurl ticket system.

http://planetargon.lighthouseapp.com/projects/4059-rubyurl

Enjoy!

UPDATE Ryan McGeary was kind enough to be the first person to help track down a bug and submit patches. :-)

Deploying Rails with an interactive Capistrano recipe to your Boxcar

Robby Russell — Thu, 28 Feb 2008 16:27:00 -0600

I wanted to share something that I’ve been meaning to share on here.

When we began planning Rails Boxcar, we really want to reduce the amount of work that it took to setup and deploy a VPS for a Rails application. During this period, we began to look at the deployment process itself and began working on an interactive tool for developers for setting up their deployment environment on their Boxcar instances. So, we worked with few customers to develop an interactive Capistrano recipe.

The Goal? Spend less time configuring the server or editing recipe files.

During the initial setup, we can have the customer provide a few details from the safety of their Rails application directory by answering the following.

What database server will you be using? (PostgreSQL or MySQL)
What port does your database run on? (if different than the default for your db server)
What is your database username?
What is your database user’s password?
What port will your mongrel cluster start with?
How many mongrel servers should your cluster run?

Great… setup the server and let’s deploy!

Uploaded with plasq’s Skitch!

Feel free to snag our interactive Capistrano2 recipe.

We’re trying to take the pain out of deploying your Ruby on Rails applications with Boxcar.

On a side note, we’re in the process of expanding our team and recently hired Alex Malinovich. Do stay tuned as we’ll be posting important announcements about changes to our Rails hosting services in the next few weeks. (grin)

Installing Ruby on Rails and PostgreSQL on OS X, Third Edition

Robby Russell — Tue, 22 Jan 2008 11:55:00 -0600

Over the past few years, I’ve helped you walk through the process of getting Ruby on Rails up and running on Mac OS X. The last version has been getting a lot of comments related to issues with the new Apple Leopard, so I’m going this post will expand on previous installation guides with what’s working for me as of January 2008.

The following guide is how our development team at Planet Argon prefers to setup our development workstations

During this installation, we’ll have what we feel is the optimal development stack for building Ruby on Rails applications with our favorite database server, PostgreSQL.

Ready? Let’s get started…

Phase One

During this initial phase, we’re going to install the underlying dependencies that we’ll be building off of.

XCode 3.0

The first thing that you’ll need to install to get far with this process is XCode tools, which is distributed by Apple. You can find this on the DVD that your Leopard installer is on. You can also download the latest version from Apple’s developer site.

http://developer.apple.com/tools/download/

The current version (3.0) is 1.1 GB.. so the download time will vary depending on your connection speed. I would encourage you to drink some tea and/or read a book

Once you finish the installation, you can move forward. The rest of these installation will not work until XCode is installed. :-)

MacPorts

In this next step, we’ll install MacPorts (formerly known as DarwinPorts). The MacPorts web site describes itself as, “an open-source community initiative to design an easy-to-use system for compiling, installing, and upgrading either command-line, X11 or Aqua based open-source software on the Mac OS X operating system.”

This tool is about to become one of the most important tools on your operating system as it’ll be used time and time again to maintain your libraries and many of the Unix tools that you’ll be using. If you’re from the Linux or BSD world, you are likely familiar with similar tools… such as: apt-get, port, and yum.

First, you’ll want to download MacPorts and install the “dmg” disk file for Leopard at the following link.

http://www.macports.org/install.php

Once downloaded, you’ll want to run the installer and install it on your workstation.

Work you way through the installer until successfully installed.

Once this finishes, you can open up your favorite terminal application and run the following to test that it installed properly.

In my case, I’m now using Terminal.app.

Issue the command: /opt/local/bin/port version

If it responds with a version number like mine did in the screenshot above, we’re moving along nicely.

Environment Paths

When we install MacPorts, the command to install/update ports installed to /opt/local/bin. We had to provide the entire path as this isn’t currently showing up in the default $PATH on Leopard. Let’s quickly remedy this by modifying the file /etc/profile.

If you have Textmate installed, you can run the following from your terminal: mate /etc/profile

Add the following line to the bottom of /etc/profile.

export PATH=/opt/local/bin:/opt/local/sbin:$PATH

You can use your favorite editor to update this file. Once you save it, you’ll want to restart your terminal application (or open a new tab) to create a new session. When your new terminal opens, run the following to verify that port is showing up in your $PATH.

which port

You should see /opt/local/bin/port show up as the result of this command.

Great, let’s continue to move forward.

Hiding Apple’s Ruby, Gems, and Rails

Before we install Ruby from MacPorts, we’ll go ahead and hide Apple’s Ruby installations.


    :~ robbyrussell$ sudo su -
    Password:
    :~ root# mv /usr/bin/ruby /usr/bin/ruby.orig
    :~ root# mv /usr/bin/gem /usr/bin/gem.orig
    :~ root# mv /usr/bin/rails /usr/bin/rails.orig
    :~ root# logout

If you ever decide to remove MacPorts, you can just rename ruby.orig back to ruby and you’re back where you started… and the same for the others listed.

Phase Two

During this next phase, we’re going to install Ruby and Ruby on Rails.

Installing Ruby via MacPorts

Now that we have MacPorts up and running, we’re going to use it for the first time. We’ll start by using it to install Ruby and the Rubygems package.

$ sudo port install ruby rb-rubygems

Okay, this will take a little while. I’d suggest that you step out to get some fresh air.

How was it outside? What’s the weather like there today? It’s currently 2:30am PST so it’s dark and an 28F outside so I didn’t stay outside very long.

If you’re still waiting for it to install, perhaps you could watch the following video. I might encourage you to check out more of Jam, which was recommended a few years ago to me by James Adam at Canada on Rails.

Be warned… it’s a strange show, but I find strange things like this funny. :-)

If you prefer something a bit more lighthearted…

Okay… when Ruby finishes installing, you’ll want to test that you can run it.

$ ruby -v

Great, let’s move forward!

Installing Ruby on Rails via RubyGems

We’re now going to install the libraries that make up Ruby on Rails via RubyGems.

$ sudo gem install --include-dependencies rails

This will install the following gems.

rails-2.0.2
rake-0.8.1
activesupport-2.0.2
activerecord-2.0.2
actionpack-2.0.2
actionmailer-2.0.2
activeresource-2.0.2

Excellent, let’s move forward…

If you haven’t already purchased it, I recommend that you take a look at The Rails Way (Addison-Wesley Professional Ruby Series) by Obie Fernandez.

Installing Mongrel via RubyGems

Let’s now install Mongrel, which is an excellent Ruby-based web server for Ruby on Rails applications. We use it in development and production at Planet Argon and it’s also what we recommend to our hosting customers.

$ sudo gem install --include-dependencies mongrel mongrel_cluster

Note: Be sure to select the proper platform for mongrel. (hint: OS X is NOT mswin32)

My terminal output:


Select which gem to install for your platform (i686-darwin9.1.0)
 1. mongrel 1.1.3 (java)
 2. mongrel 1.1.3 (i386-mswin32)
 3. mongrel 1.1.3 (ruby)
 4. mongrel 1.1.2 (ruby)
 5. mongrel 1.1.2 (mswin32)
 6. mongrel 1.1.2 (java)
 7. Skip this gem
 8. Cancel installation
> 3
Select which gem to install for your platform (i686-darwin9.1.0)
 1. fastthread 1.0.1 (mswin32)
 2. fastthread 1.0.1 (ruby)
 3. Skip this gem
 4. Cancel installation
> 2
Building native extensions.  This could take a while...
Building native extensions.  This could take a while...
Successfully installed mongrel-1.1.3
Successfully installed gem_plugin-0.2.3
Successfully installed daemons-1.0.9
Successfully installed fastthread-1.0.1
Successfully installed cgi_multipart_eof_fix-2.5.0
Installing ri documentation for mongrel-1.1.3...
Installing ri documentation for gem_plugin-0.2.3...
Installing ri documentation for daemons-1.0.9...
Installing ri documentation for fastthread-1.0.1...

No definition for dummy_dump

No definition for dummy_dump

No definition for rb_queue_marshal_load

No definition for rb_queue_marshal_dump
Installing ri documentation for cgi_multipart_eof_fix-2.5.0...
Installing RDoc documentation for mongrel-1.1.3...
Installing RDoc documentation for gem_plugin-0.2.3...
Installing RDoc documentation for daemons-1.0.9...
Installing RDoc documentation for fastthread-1.0.1...

No definition for dummy_dump

No definition for dummy_dump

No definition for rb_queue_marshal_load

No definition for rb_queue_marshal_dump
Installing RDoc documentation for cgi_multipart_eof_fix-2.5.0...
Successfully installed mongrel_cluster-1.0.5

Great, you have almost all of the essentials.. except a database.

Phase Three

In this phase, we’re going to get our database server, PostgreSQL, installed and the libraries that Ruby needs to communicate with it.

Installing PosgreSQL with MacPorts

At Planet Argon, we design and develop our applications on top of PostgreSQL. I’ve been advocating the adoption of this awesome open source database in the Rails community for quite some time now.

The current version available of PostgreSQL via MacPorts is 8.3, which is what we’ll now install with the port command.

$ sudo port install postgresql83 postgresql83-server

This will download and install the necessary libraries to run PostgreSQL server and the client utilities.

Configuring PostgreSQL

When PostgreSQL is finished installing, it’ll tell you to run the following commands to create a new database instance.


 sudo mkdir -p /opt/local/var/db/postgresql83/defaultdb
 sudo chown postgres:postgres /opt/local/var/db/postgresql83/defaultdb
 sudo su postgres -c '/opt/local/lib/postgresql83/bin/initdb -D /opt/local/var/db/postgresql83/defaultdb'

Adding PostgreSQL to launchd

If you’d like to have PostgreSQL automatically startup after a system restart, you can load it into launchd, which comes with OS X. By running the following command, PostgreSQL will startup automatically on the next system restart.

sudo launchctl load -w /Library/LaunchDaemons/org.macports.postgresql83-server.plist

Adding PostgreSQL to your $PATH

For some reason, the MacPort for PostgreSQL doesn’t get the programs in your path automatically, so we’ll it now.

mate /etc/profile

Modify the PATH that we changed earlier to include /opt/local/lib/postgresql83/bin@.

export PATH=/opt/local/bin:/opt/local/sbin:/opt/local/lib/postgresql83/bin:$PATH

Save the file and then open a new terminal. To test this, you should get the following output when you run which psql.


  $ which psql
  /opt/local/lib/postgresql83/bin/psql

Creating a new PostgreSQL user

When I’m working on Rails applications in my development environment, I really don’t want to have to specify a username and password in every config/database.yml file for each of our ongoing client projects. When PostgreSQL was installed, it created a superuser named postgres, which is great, but I’d like one that matches my system username, so that I’m not prompted at all for a username or password to connect to PostgreSQL.

To do this, we’ll use the createuser command, which comes with PostgreSQL. As you can see, I’m creating a new user with superuser privileges (and will hopefully be the last time I have to do a -U postgres).


  $ createuser --superuser robbyrussell -U postgres
  CREATE ROLE

Let’s take a quick moment to test this out.


  # create a new database
  $ createdb my_test_db
  CREATE DATABASE

  # drop the database
  $ dropdb my_test_db
  DROP DATABASE

Great, everything looks good here.

We now have a running installation of PostgreSQL with a new user account. All we need to do now is install the appropriate RubyGem to allow our Ruby applications to connect to it.

Installing PostgreSQL Libraries for Ruby

You can install postgres gem by running the following command.

$  sudo gem install --include-dependencies postgres

Great. We’ve now built a professional development environment for working with Ruby on Rails. Can you feel the excitement? :-)

Closing Thoughts

Like the previous versions, I hope that a few people find this useful. I didn’t have to make a lot of changes from the second edition, but there were enough to warrant a new post. I’ve been setting up my workstation like this for about three years now and I’m looking forward to seeing how a fresh install on Leopard works out for me.

If you have any problems, feel free to ask a question in the comments below.

PGCon 2008 - Call for Papers

Robby Russell — Fri, 28 Dec 2007 10:58:00 -0600

Are you using PostgreSQL (the world’s most awesome open-source database server) with Ruby on Rails? Do you have any interesting experiences that you might want to share with an audience? Well, you might consider submitting a talk proposal for PGCon 2008, which is taking place in Ottawa, Canada.

Details follow…

PGCon 2008

PGCon 2008 will be held 22-23 May 2008, in Ottawa at the University of Ottawa. It will be preceded by two days of tutorials on 20-21 May 2008.

We are now requesting proposals for presentations.

If you are doing something interesting with PostgreSQL, please submit a proposal. You might be one of the backend hackers or work on a PostgreSQL related project and want to share your know-how with others. You might be developing an interesting system using PostgreSQL as the foundation. Perhaps you migrated from another database to PostgreSQL and would like to share details. These, and other stories are welcome. Both users and developers are encouraged to share their experiences.

Here are a few ideas to jump start your proposal process:

novel, unique or complex ways in which PostgreSQL are used
migration of production systems to PostgreSQL
data warehousing with PostgreSQL
tuning PostgreSQL for different work loads
replicating data on top of PostgreSQL

Both users and developers are encouraged to share their experiences.

The schedule is:

19 Dec 2007 Proposal acceptance begins
19 Jan 2008 Proposal acceptance ends
19 Feb 2008 Confirmation of accepted proposals
19 Apr 2008 Final papers/slides must arrive no later than this date

Instructions for submitting a proposal to PGCon 2008 are available from: http://www.pgcon.org/2008/submissions.php

This

Rails Business: Year Review for 2007

Robby Russell — Mon, 24 Dec 2007 20:54:00 -0600

Happy Holidays!

Wow, 2007 has gone by really fast. I’ve been fairly busy wrapping up projects and getting ready to start new ones at Planet Argon. I’m sure that when many of you start a new project… you look back at what you’ve learned from previous ones. Even throughout iterations in a project, we try our best to have retrospectives to be sure that we’re all learning from what has and hasn’t worked. A few weeks ago, I decided to drop a note to the members of the Business of Rails community to ask people to share some of their lessons from the year. My goal was to get people to share their experiences from over the year with other members of the community and see where the dialogue takes us into 2008.

As expected… I got some great responses, which I encourage you to read for yourself. You might even participate in the conversation(s) and share your experiences. We’d love to hear them.

Side note… I’d like to thank all of you who have participated in the Business of Rails community over the year. It was an idea that came to me during RailsConf 2007 after I participated on a panel with other business leaders in the Ruby on Rails community. We now have over 800 members on the mailing list! I’ve learned a lot from the community and hope more of you decide to join. :-)

Using MacPorts Ruby and Rails after Upgrading to OS X Leopard

Robby Russell — Sat, 27 Oct 2007 05:43:00 -0500

If you previously followed my article, Installing Ruby on Rails and PostgreSQL on OS X, second edition and are now upgrading to OS X Leopard, you’ll want to make a few adjustments to your setup.

First of all, it’s great that Apple has decided to provide Ruby on Rails out of the box.


~ > gem list rails                                                                                                                                                                   
  *** LOCAL GEMS ***

  rails (1.2.3)
      Web-application framework with template engine, control-flow layer,
      and ORM.

How many gems does it come with?


~ > gem list|grep '^[a-z]'|wc -l                                                                                                                                                     
      29

It’s really great that Apple shipped Leopard pre-installed with 29 gems, especially if you don’t have your entire Rails stack setup already. In my case and for those that have followed my installation process, you don’t need to switch over to this new development stack (yet). I have a lot of time invested in my fully-functionaly MacPorts installation process (PostgreSQL, MySQL, RMagick, Subversion, Git, etc. Since this all working fine on my machine, I’m not ready to make the switch to Apple’s installation.

Don’t Fix it… if it’s not broken!

So, the the first thing that I did was modify my PATH environment variable, which has /usr/bin as the first path that it’ll look at when you try to run commands like ruby, mongrel_rails, gem, etc. You’ll want to modify this and prepend /opt/local/bin: to the front of PATH in your shell configuration. If you’re using bash, this would be… ~/.bashrc. If you’re using zshell like me, ~/.zshrc.

Now, when you start a new Terminal and run gem list, you’ll see all of the gems that you already have installed.


~ > gem list rails                                                                                                                                   < new-host

*** LOCAL GEMS ***

rails (1.2.5, 1.2.4, 1.2.3, 1.1.6)
    Web-application framework with template engine, control-flow layer,
    and ORM.

Back to my happy gems…


~ > gem list|grep '^[a-z]'|wc -l                                                                                                                                                              < new-host
      72

Great! Now I can get back to work and spend time playing with the new features in Finder, Mail.app, and iChat instead of installing all of the software dependencies that our development projects have. :-)

Chad Fowler's Dirty Little Secret?

Robby Russell — Sat, 06 Oct 2007 15:00:00 -0500

I saw this photo of the Microsoft team from 1978 on Anselm’s flickr and thought, “Hmm, that looks like Chad Fowler!”

Could this be Chad Fowler’s dirty little secret?..

Happy Saturday!

PLANET ARGON is seeking fresh talent... could it be you?

Robby Russell — Thu, 04 Oct 2007 10:10:00 -0500

My blog has been fairly quiet lately because our team has been busy helping push a few big client projects out the door. We’ll be posting announcements about those launches on the PLANET ARGON Blog soon, so stay-tuned there!

We’ve been growing the design-side of our team lately, but we’re also still seeking some more Rails-talent in Portland, OR. If you’re in Portland or interested in moving here¹, you should introduce yourself to our team. We’re looking for people to work on-site in Portland, so any remote candidates will be turned away… we’re moving into a shiny and new office space in downtown and are looking for another developer to join our Design and Development team.

you’ll fit in really well if you’re into outdoor activities… ;-)

We’re seeking mid-level Ruby on Rails developers that can pick things up quickly. Having some experience with RSpec will go along way with us. Ideal candidates would have great communication skills and be able to work in a fast-paced environment that places a huge emphasis on collaboration between designers and developers (let’s not forget to mention our clients). Bring what you already know and learn the rest with us.

While everyone might have Wii’s in the office, we’ve taken it to the next level with Speed Stacking! :-p

To apply, send an email to af22+8509@c1.catchthebest.com,

Side note: We’re giving Catch the Best a whirl to review job candidates. If you’re hiring people, you might consider giving it a try.

¹ Everybody is moving to Portland… ;-)

Edge Rails Documentation: Revisited

Robby Russell — Wed, 26 Sep 2007 08:34:00 -0500

This question, “where can I find documentation for Edge Rails?” still comes up quite often on mailing lists, IRC, and other places. I just wanted to point out a few resources for you.

In March 2006, our team announced that we’d be updating a RDOC site a few times a day as the Rails project gets commits.

You can still access the PLANET ARGON Edge Rails documentation here:

http://edgedocs.planetargon.org

Caboose also has some Edge Rails documentation here:

http://caboo.se/doc.html

If you’re aware of any other online resources for Edge Rails documentation, please let me know.

Rails Business: "Weekly" Review #4

Robby Russell — Tue, 25 Sep 2007 08:59:00 -0500

As I mentioned in my last review, I wouldn’t be updating on a weekly basis, which is a shame because there are so many fascinating discussions going on that might benefit you if you’re running a business that uses and/or relies on the Ruby on Rails framework. I’d like to highlight some of the discussions that have been taking place over the past month or so.

First off… wow! As of this morning, there are 650 members!

Some Recent Discussions

Obtaining Ruby Gigs

Johan Pretorius started a discussion with the following…

“I’ve been lurking on the group for a while now, the time has come to participate … What strategy would you recommend for somebody that wants to break into the Ruby (on Rails) market?”

On a related topic, Jose Hurtado started a discussion asking for tips on how to get a reputation in the Ruby on Rails community for you business.

Some of the responses included:

Start a portfolio
Contribute to Open Source projects
Contribute to Rails through Documentation
Subcontract through well-known developers
Start a blog
Write a book

Read the entire thread and please share any other ideas that you have on this topic with Johan, Jose, and rest of the list. :-)

Taking a full-time job, what about your freelance clients?

Oren writes, “I got a full-time job offer as employee (and not on as a contractor). My current client might need some help on the weekends in the next month, so I might still do contract work. Can I keep my corporation (corp S) while working full time?”

Read the responses

Reality Check!

Starting your own business might sound like an amazing thing to do, but it often comes with a lot of consequences and struggles, which I’m definitely not been immune to.

Michael M. writes, ”...added to having to create a company, perform customer support, continue to grow the features, marketing, and the loads of other things I haven’t thought of yet…is there any hope that one person can pull this off while still working at my current job ( with hopes of going it alone when I’m sure it can fly ), and giving time to my family, with very little up front costs. I’ve been reading quite a bit about bootstrapping lately, but to really make the time has been very difficult.”

There were several thoughtful responses where well-known members of the Ruby on Rails community, such as Joe O’Brien Ben Curtis shared through personal experiences.

Joe O’Brien wrote, “I wanted to mainly chime in on the family part. Something that has taken a year for me to figure out how to balance. I would not have been able to do any of it, had it not been for my wife’s full support. I have three kids, all of whom I love spending time with, so figuring out a way to balance it all has been very tricky. Up front though, my wife and I knew this would not be your typical job. It helped that I used to travel and now do not, but it has still been an adjustment.”

If you’ve been running your own Rails business, please consider responding to this thread and sharing your experience.

Join the Community

As mentioned, this is just a small sample of some of the great discussions taking place on the Rails Business mailing list. If you’re an aspiring Rails freelancer or business owner, be sure to join the community and share your experiences and learn from other members of the community that are willing to share theirs.

As always, have fun!

Boxcar: Open for business

Robby Russell — Tue, 04 Sep 2007 13:04:00 -0500

We’ve been quietly rolling out our new Rails hosting solution over the past month, each week… inviting more people to ask questions and place orders. Initially, we invited some of our business hosting customers, and then sent out invites to those who signed up on the Rails Boxcar announcement list. We’ve been taking orders for the past few weeks and have had sites running on Boxcar for over a month now.

You’ll also notice that we’ve begun to phase out all of our older shared hosting solutions for new customers and are focusing solely on our Business and Boxcar accounts (aside from custom managed/dedicated solutions that we’ve been offering upon request).

To learn more about Rails Boxcar, read the announcement on the PLANET ARGON blog.

In other news, Daniel Johnson, our Lead Systems Administrator broke his arm while riding his bike while participating in Zoo Bomb (and cracked his helmet in the process). He’s at home today on pain medicine and we hope that he has a swift recovery.

RubyURL: new design and code base

Robby Russell — Wed, 08 Aug 2007 08:58:00 -0500

Yesterday evening, I deployed the new version of RubyURL. This was a collaborative effort between Chris Griffin and I, which we’re happy to finally push live.

There are a few things that we’re going to push out in near future, such as an API and a new RubyGem.

Chris volunteered to work on the new design and I did most of the programming in Ruby on Rails. When we worked on this, we really wanted to keep the process as simple as possible, despite some of the problems that the site has been having.

In the end, we have a Rails application that is only 85 lines of code and has a 1:2.3 code-to-spec ratio. I wanted to keep it under 100 lines of code. This means that there is some breathing room for further development.

We also tried out a beta account that I was given for RoundHaus for Subversion hosting. We had a really good experience using their service and were impressed by the plethora of useful features that came with the repository, such as continuous integration, rcov/code coverage stats, and twitter integration!.

If you find a bug, be sure to submit a ticket on the RubyURL bug tracker.

On a side note, we deployed this on a brand new Rails Boxcar, our new hosting solution that will be launched in the very near future. ;-)

Rails Business: "Weekly" Review #3

Robby Russell — Sun, 05 Aug 2007 10:37:00 -0500

It’s been about six weeks since the last Rails Business “Weekly” Review on here, so perhaps it’s worth changing the name to cut me some slack on not being consistent. ;-)

Since the last post, we’ve gone from around 400 members to 555 as of this morning. We’ve had 562 messages as well, so there hasn’t been a shortage of discussions taking place. I’d like to take a few moments to highlight some of the discussions that have taken place and encourage you all to consider participating, if you’re not already.

Licensing and Client Agreements

Tim Case writes,

“My client sent me this agreement drawn up from their lawyer that included the following:

(c) the Contractor shall not bundle with or incorporate into any Work Product any third-party products, ideas, processes, software, codes, data, techniques, names, images, or other items or properties without the express, written prior approval of the Company;”

Tim then goes on to ask how his applies to using Ruby on Rails, which as a MIT license and how other consultancies are handling these types of situations. Follow the discussion…

Escrow

Gustin writes, “Does anyone have any escrow experience, legal and cost? I am dealing with a client that got burned bad and we are reducing their fear with escrow on the first two iterations.”

Follow the discussion…

Project Planning tools

Mike Pence writes, “So, I used to use MS Project for the composition of those dreaded Gantt charts, but it has been a few years since I had to be so formal. Anything new and exciting – and more robust than Basecamp – happening in the world of project planning software?”

Follow the discussion…

Not long after, Jim Mulholland started a new thread on the same topic and brought up the open source application, redMine. Follow this discussion…

Ruby on Rails versus .NET

Michael Breen asked a big question on the list, which has sparked an going discussion about the benefits of using Rails versus .NET (and other platforms).

“A couple of months ago I decided to stop actively pursuing .NET gigs to focus on Rails. Several of my existing .NET clients have learned of this through the grapevine and have contacted me to discuss.”

Follow the discussion…

Three things Tim’s learned from Freelancing Rails

Tim Case shared his experience of freelancing with Ruby on Rails and highlights three things that he’s learned.

The non-code business aspect of Freelancing is demanding.
It takes 10 hours to bill 6 to 8.
Figuring out your rate is hard.

Read the rest of Tim’s observations and the discussion the followed.

Client issue tracking and documentation

Jeff Judge writes, “Hello all! I was curious to here how people are handling client issue tracking and documentation.”

Several applications were mentioned for handling issue tracking and the general consensus was that there was still a lot to be desired that current options didn’t provide. Be sure to follow the discussions…

Join the Community

These were just a small handfull of the discussions that have taken place over the past several weeks. If you’re an aspiring Rails freelancer or business owner, be sure to join the community and share your experiences and learn from other members of the community that are willing to share theirs.

Until next time, have fun!

Spec Your Views

Robby Russell — Thu, 02 Aug 2007 02:00:00 -0500

I meant to work on this post… oh about 7 months ago.

Way back in January (7 months ago), Jamis Buck posted an article titled, Testing your views, which gave a few tips on using Test::Unit to, as the title suggests, test your views.

While, I’m not going to rewrite everything that Jamis wrote, I’d like to show you how to test these views with RSpec. (you might take a moment to quickly read his post…)

In this example, I’m going to show you how we’re able to write specs for the following RHTML, which you’ll notice matches the code that he wrote tests for.


  <% if @user.administrator? %>
    Hi <%= @user.name %>! You appear to be an administrator.
    <%= link_to "Click here", admin_url, :id => "admin_link" %>
    to see the admin stuff!
  <% end %>

Jamis writes, “The only really significant thing you ought to be testing here is that the admin link only shows up for administrators. “

So, let’s do just that, but with RSpec.

I’m not sure how Jamis is handling his view tests, but we’re going to approach our view specs, much like we approach our controller specs, with the use of mocks and stubs, because we really don’t need to spec any of our models at this level in the application.

Tip: Write specifications for your models… in your model specs not in your controller or view specs.

The first thing that we’re going to do is setup a custom spec helper, because for something like an mocked user, will probably get reused in other areas of the user interface. Spec helpers are essentially modules that you can include in your RSpec descriptions (the block that starts with describe) and reuse.

In this spec helper, I’m going to include two methods, to mock the User model and stub out any of the methods that are necessary for spec’n this view.


module MockUserHelper
  def mock_normal_user
    user = mock(User)
    user.stub!(:administrator?).and_return(false)   # <--- NOT an admin
    user.stub!(:name).and_return('David Chelimsky')
    return user
  end

  def mock_admin_user
    user = mock(User)
    user.stub!(:administrator?).and_return(true)    # <--- IS an admin
    user.stub!(:name).and_return('Aslak Hellesoy')
    return user
  end
end

In the mock_normal_user method, we’re constructing a mock object and stubbing out the methods that we see are being called in the RHTML code. In mock_admin_user, we’re basically doing the same thing, but just stubbing the administrator? method to return true for this mock user.

By stubbing these methods, we’ll be able to send a non-ActiveRecord object to the view and have it render without knowing the difference. For example, the if @user.administrator? condition will return true or false, depending on how we stubbed it.

For more information on mocks and stubs, read here.

Now that we have our spec helper, let’s go ahead and dive into a few specifications for the view.


describe "index page" do
  include MockUserHelper

  it "should render an admin link for an admin user" do
    assigns[:user] = mock_admin_user
    render 'index'
    response.should have_tag('a#admin_link')
  end

  it "should not render an admin link for a normal, non-admin user" do
    assigns[:user] = mock_normal_user
    render 'index'
    response.should_not have_tag('a#admin_link')
  end
end

Please note: This code example is only longer than the one shown by Jamis because he didn’t include how he setup all his user sessions/objects. ;-)

When these specs are run, we can see the following results.

Pretty output courtesy of RSpec + TextMate bundle

Great, we’ve been able to write specifications for our Rails views without a lot of pain. Stay tuned for more posts on this topic as I continue writing about how Designers and Developers can work together, in harmony. (see my last post on this topic)

For more information on adopting RSpec, please visit the RSpec project homepage.

Designers, Developers, and the x_ Factor

Robby Russell — Wed, 01 Aug 2007 00:39:00 -0500

Our team is lucky enough to be in a position where we have both designers AND developers working on the same code base in parallel.

Since Ruby on Rails adopts the Model-View-Control pattern for separating business logic from the presentation layer, we’re able to give our designers a lot of breathing room to to design the interface, whether it’s for interaction or aesthetic reasons. However, sometimes this breathing room has resulted in small bugs slipping into the application interface. In general, nothing disastrous, but each bug that slips into the queue, slows down the project and we want to avoid as much of that as possible.

I’d like to share a few issues that we’ve seen occur on various occasions, and then show you what we’ve done to avoid them happening again.

Scenario #1: The case of the changed div id, (victim: designer)

Designer adds a few HTML elements to the page, defines an id on a <div> tag and styles it with CSS.
A few days later, a developer needs to make some changes, tests it in their favorite browser and commits.
Later, the designer doesn’t understand why the styling is all messed up. “It was working fine.”
...minutes, hours… go by where the designer tries to track down the issue. “Oh! Someone renamed the id in this <div> tag. Sigh.”
Developer apologies, but explains that he needed to do it because he needed to make it work with his new RJS code.

Scenario #2: The case of the changed div id, (victim: developer)

Developer is implementing this cool new Ajax feature into the web application
- The code relies on there being one or many HTML elements in the DOM with specific id values defined.

Example: <div id="notification_message">

A few days later, a designer is making some changes to the layout and needs to restyle some of the view that this <div> tag is defined. Designer decides to change the id to a different value for any variety of reasons. (or perhaps they changed it to use a class instead of styling it by the id). Often times, we don’t know who set the id or class… and many times the developers aren’t savvy enough with HTML and designers end up cleaning things up a bit.
Later, code is checked in and designer didn’t notice that the Ajax was now breaking as they weren’t focusing on just the layout.
Day or two later, developer sees bug, “Feature X isn’t working, throwing JavaScript error…”
Developer is confused, “Hey, that was working! What happened?”
Developer tracks down the problem, discusses with designer, they figure out a solution. Problem solved.

I could outline a few other examples, but I really wanted to highlight these two types of situations, as our team has seen this happen on several occasions. Luckily, we’ve learned through these experiences and have taken some measures to try and avoid them in the future.

Moving forward (together)

Both of the examples above, were essentially the same problem, but resulted in problems for a different role in the design and development cycle. While, I’ve definitely been the victim of #2 several times myself, I know that I’ve also been the guilty of #1. So, what can we do as designers and developers to work with each other without causing these little problems from occurring? (remember: many little problems can add up to a lot of wasted time spent resolving them)

Several months ago, I had a meeting with Chris (User Interface Designer) and Graeme (Lead Architect/Developer) to discuss this very problem. At the time, we were implementing a lot of Ajax into an application and were occasionally running into Scenario #2. We discussed a few possible ways of communicating that, “yes, this div id should NOT be changed (without talking to a developer first)!”

Idea 1: Comment our “special” HTML elements

We discussed using ERb comments in our views to do something like the following.


  <% # no seriously, please don't change this id, it's needed for some Ajax stuff %>
  <div id="notification_message">
    ...

We all agreed that, while effective, it was going to clutter up our RHTML code more than any of us desired.

Team Response: Meh.

Idea 2: Reserve id’s for developers

Another idea that came up, was to ask that designers only use classes and ids wold be used by the developers when they needed it.


  <div id="developer_terriroty" class="designer_territory">
    ...

Chris pointed out that this wasn’t an ideal solution as there is a distinct case for when to use ids versus classes.. and he is very strict about adhering to the HTML/CSS standards.

Team Response: Not hot about it…

Idea 3: Naming convention for Ajax-dependent elements

The third idea that was discussed, was specifying a naming convention for any elements that were needed by our Ajax code. We played around on the whiteboard with some ideas and settled on the idea that we’d prefix our id’s with something easy to remember for both designers and developers.

We agreed on… x_ (x underscore), which would make an element id look something like this:


  <div id="x_notification_message">
    ...

x == ajax... get it?

While this adds the strain of typing two more characters to much of our RJS code, we don’t run into Scenario #2 very often anymore.


  render :update do |page|
    page[:x_notification_message] = 'Something exciting happened... and this is your notification!'
    page[:x_notification_message].visual_effect :highlight
  end

or in client-side JavaScript (where we also use this)...


  $('x_notification_message').do_something

I find that this helps our team keep a clear distinction between what can and shouldn’t be changed in the views by our designers. Sometimes they have a good reason to do so, but they know that if there is x_, then they should ask one of the developers on the team for assistance in renaming it without causing any problems in the application. It also allows our designers to add classes to these elements, or style the id that we’ve defined.

Team Response: Wow, was that all we needed to agree on? Hooray!

This leads me to some other problems that have/may come up, but I’ll discuss that in my next post on this topic, when I’ll show you how we can use RSpec to avoid these sorts of designer versus developer problems.

If you’re working in a similar environment, how are your designers and developers working, together, in perfect harmony?

Until next time, remember to hug your designer. ...and if you’re still having developer design your applications, consider hiring a designer. ;-)

UPDATE: changed examples after a few comments about using div_for as another solution. (see comments for details)

YSlow and Rails performance: Getting UJS and AssetPackager to play nice

Robby Russell — Fri, 27 Jul 2007 13:40:00 -0500

Yesterday, I started to dig deeper into YSlow and decided to pick an application that we recently launched for a client. The performance grade that I saw at first was an F, which wasn’t surprising to me because we knew that there was going to be some fine tuning in the near future.

There is a lot of JavaScript in this application and we have several files to break up stuff to make it more maintainable. However, in production, we really don’t need to send the client (browser) 19 different JS files. We’ve been using mod_deflate to compress these files, but it doesn’t solve the problem of having several connections opening to download all the necessary JavaScript. The same is true for our CSS files.

At RailsConf, DHH announced that an upcoming version of Rails would bundle all the stylesheet and javascript files into one file and compress it. We’re running on 1.2.x for this application and decided to look at the AssetPackager plugin as a good solution to this problem.

I installed the plugin via piston and ran the following task, which is provided by AssetPackager.

rake asset:packager:create_yml

This went ahead and created config/assets_packager.yml. I then went ahead and updated our capistrano configuration to call the rake task after updating the code on the server when deploying.


desc "all of our other tasks/commands to run after updating the code" 
task :after_update_code do
  #
  # all of our other tasks/commands
  #
  run "cd #{release_path} && rake RAILS_ENV=production asset:packager:build_all" 
end

The first thing that I noticed was that the yml file that gets generated will not make any assumption as to what order the javascript libraries should be loaded. So, immediately, line 1 of our compressed javascript file was causing an error as the code was trying to reference a library that hadn’t been defined yet (showed up later in the file). So, when you do this, you’ll need to organize the yml file to load things in order that they are needed. This was also a good opportunity for us to say, “oh, we’re not using that one anymore. Let’s remove it.”


--- 
javascripts: 
- base: 
  - prototype  
  - effects
  - scriptaculous
  - controls
  - dragdrop
  - application
  - slider
  - pngfix
  - nav
  - lowpro
  - lightbox
  - folder
  - builder

Great, so we re-dployed and everything at first glance seemed fine… or so we thought!

We used the unobtrusive javascript plugin for this project and it seems that we couldn’t just compress every single file. Each page has a behaviors javascript file and since everything was being compressed into one file (and cached), RJS calls quickly broke throughout the site. OH NO!

So, I opted to merge all of the other javascript files and use the standard way of including unobtrusive javascript in the application layout.


<%= javascript_include_merged :base %>
<%= javascript_include_tag :unobtrusive %>

We also removed lowpro from the list of javascript files to compress since the ujs plugin is currently including this when we call <%= javascript_include_tag :unobtrusive %>. I plan to look into modifying this so we it’ll only include the page-specific behaviors and not load the lowpro javascript file (so we can compress that as well).

Once this was re-deployed, we saw that the RJS issues were resolved and everything felt to be loading quicker. But, let’s look at YSlow again for step 1 in improving the performance of the application.

side note: the following grading was also after making some other adjustments that were suggested by YSlow, which I’ll discuss in another blog post soon.

So, where we once had a grade F, we now have an D… which is due to the client having us add several (four) external javascript files for mint, google analytics, etc. We’re only loading 3 javascript files for the application, when we were originally loading many more.

Obviously, there is some more tuning to be done, but we went from a grading of 43 to 74 in about three hours of time spent reading the YSlow documentation, adding asset_packager, and making various tweaks to our web servers (as suggested by YSlow).

Until next time…

Every Second Counts with a Piston in your Trunk

Rails Code Audit Tips - Filtered Parameter Logging

Robby Russell — Mon, 16 Jul 2007 22:50:00 -0500

It’s been a month since I posted, Audit Your Rails Development Team and now I find myself sitting in a hotel room in Mankato, Minnesota with Graeme after a long day of walking through the documents that we delivered to our client after conducting a Rails Code Audit and Review. Our client felt that it would be a great idea to have us visit with six of their employees and walk through the various topics that we brought up in our process. We’ve been doing several of these audits recently and are thought that it would be a good idea to begin sharing some problems that we’ve discovered across projects.

As much as we like to find lots things that we’d recommend improving in Rails applications, we also want to make sure that as many projects as possible avoid some of these common oversights. So, expect to see more posts related to things that we find through our Code Audit and Review process.

Today, I’d like to point out a potential security problem that is often overlooked by developers and system administrators.

Log files.

Does your application request any of the following information from your users?

Social security number
Credit card date (number, expiration date, etc..)
Passwords

BY DEFAULT, all of this data is being written to your production log file. Even if you’re encrypting this data in your database, request parameters (get/post) are all written to your production logs without any encryption. Log files are also notorious for having insecure file permissions, so if you’re on a shared host, other accounts on the server might be able to view them. Regardless of how secure you think your server is, this isn’t data that you want sitting around.

Lucky for you, Ruby on Rails has an easy solution to this problem! All that you need to do is use the filter_parameter_logging method in your controller(s). We generally add something like the following to our application controller.


  filter_parameter_logging :social_security_number, :password, :credit_card_number, 'some-other-param'

This will replace the value from the parameters with [FILTERED], which solves this problem rather nicely.

So, it would be our recommendation, that if your application is storing any sensitive data, that you take advantage of this simple solution. Be sure to read more about filter_parameter_logging before you implement this for various usage examples.

Stay tuned for more tips and tricks. If you’re interested in contracting us for our Rails Code Audit and Review service, give us a call.

Tomorrow, Graeme and I will be meeting for another day with our clients and then we fly home to Portland, Oregon in the evening. We survived our first tornado warnings, which was exciting as we don’t get those on the west coast. ;-)

RubyURL 2.0 on the horizon

Robby Russell — Mon, 16 Jul 2007 22:23:00 -0500

RubyURL was a project that I built about 2 1/2 years ago as a late night attempt to see what I could build and deploy with Ruby on Rails in a night. It’s nearing 50,000 unique website links, has a Ruby gem that you can use with it, and rbot plugins.

I’ve rewritten it about three times in the past six months, to try out some new approaches, but haven’t deployed with a new version as I’ve been waiting for someone to help me with a new design. Chris has offered to help out and once we integrate his new design with it, we’ll be launching it.

Everything is not great in RubyURL land though. It appears that it’s become an easy target for comment spammers to abuse the site to generate rubyurls and paste those links in their spam comments. Several pissed off bloggers, forum administrators, and system administrators have emailed me to complain that I’m spamming their site. Sadly, even with a basic disclaimer on the site, they still like to blame me for their spam. It’s gotten common enough, that I’ve written a template email that I respond with that explains how the site works and that I’m not accountable for people posting links to my URL redirect tool.

You can see that it’s popping up around the net via a google search.

So, I’ve been trying to think of ways to make it easier for people to flag URLs as being abusive of the site. I’ve not come up with any elegant solution that doesn’t force the good users of the site to have more steps in their process to create a basic RubyURL.

The ideal (and current) workflow:

User navigates to http://rubyurl.com
User pastes in long url into text box/area
User submits form
User is provided with new (shortened) rubyurl
User copies the rubyurl and does what they want with it (generally… pastes into IM, IRC, Email, etc.)

Some people have suggested using a user system to do this, but I really don’t like that as a solution.

Another idea, which I built… and later removed from my new version, involved having the original url load in a frame, and then provide a way for users to flag it as ‘spam’, ‘nsfw’, or ‘dead’. Then, we could provide the user with a warning that the following URL was flagged before, are you sure you want to continue? I didn’t like this as a solution in this way as it felt very obtrusive to have a rubyurl frame at the top of the browser window.

One person suggested a captcha to try and verify that the user is human, but there are problems with this.

I really dislike captchas. ;-)
This doesn’t prevent spammers from using the ShortURL gem, which does everything via an API.

In regards to the API, this could be enhanced by requiring that everyone register an email address to get an API key, but only solves the API abusers.

I’m starting to brainstorm some solutions that specifically help the requests made through the web. I haven’t checked the logs enough yet to verify it, but I have a strong suspicion that much of the abuse is happening through a web-based bot, not through ShortURL… because Ruby developers are nicer than that. (I hope…)

So, I am curious… dear readers of my blog. How might you solve this problem without disrupting the user experience? Or, should I just stick with what I’ve got going and find a better way to respond to pissed off bloggers who think I’m spamming them?

Discuss…

Robby on Rails: Tag rails

New Boxcar plans announced!

Boxcar Conductor plugin moved

Boxcar on Twitter

Boxcar Conductor: Rails deployment made easy

Introducing Boxcar Conductor

Install Boxcar Conductor

Configure Your Boxcar

Related Posts

Announcing Cobalt and monthly subscriptions for Boxcar

Managing Required Gems on Rails Projects

Managing SEO-friendly HTML Titles with Rails

Problem: HTML titles

Instance Variable

The content_for helper method approach

Which is the better solution?

Things (in the Rails world) You Don't Yet Understand

DRY(a): Year After Year

Introducing Year after Year

Installation

Updates…

The Argon Express 2008? It's not too late!

Launch your own RubyURL

Deploying Rails with an interactive Capistrano recipe to your Boxcar

Installing Ruby on Rails and PostgreSQL on OS X, Third Edition

Phase One

XCode 3.0

MacPorts

Environment Paths

Hiding Apple’s Ruby, Gems, and Rails

Phase Two

Installing Ruby via MacPorts

Installing Ruby on Rails via RubyGems

Installing Mongrel via RubyGems

Phase Three

Installing PosgreSQL with MacPorts

Configuring PostgreSQL

Adding PostgreSQL to launchd

Adding PostgreSQL to your $PATH

Creating a new PostgreSQL user

Installing PostgreSQL Libraries for Ruby

Closing Thoughts

PGCon 2008 - Call for Papers

PGCon 2008

Rails Business: Year Review for 2007

Using MacPorts Ruby and Rails after Upgrading to OS X Leopard

Don’t Fix it… if it’s not broken!

Chad Fowler's Dirty Little Secret?

PLANET ARGON is seeking fresh talent... could it be you?

Edge Rails Documentation: Revisited

Rails Business: "Weekly" Review #4

Some Recent Discussions

Obtaining Ruby Gigs

Taking a full-time job, what about your freelance clients?

Reality Check!

Join the Community

Boxcar: Open for business

RubyURL: new design and code base

Rails Business: "Weekly" Review #3

Licensing and Client Agreements

Escrow

Project Planning tools

Ruby on Rails versus .NET

Three things Tim’s learned from Freelancing Rails

Client issue tracking and documentation

Join the Community

Spec Your Views

Designers, Developers, and the x_ Factor

Moving forward (together)

Idea 1: Comment our “special” HTML elements

Idea 2: Reserve id’s for developers

Idea 3: Naming convention for Ajax-dependent elements

YSlow and Rails performance: Getting UJS and AssetPackager to play nice

Rails Code Audit Tips - Filtered Parameter Logging

RubyURL 2.0 on the horizon

The `content_for` helper method approach