Larry Ullman

Translating Geek Into English

A Simple Approach to Site Security

There are two kinds of security that Web sites, applications, and operating systems can provide: perceived security and actual security. Perceived security is still important, because that’s what convinces users that it’s safe to, for example, provide their personal information to your Web site. But actual security is the key. Think of it as the difference between having a sign in front of your house saying it’s protected by a security system and actually having a security system. But if you’re anything like me, you’ve never tried to hack someone’s Web site and aren’t generally inclined to think like a person who would, so how do you make your sites secure? Here’s what I do…

The Second Rule of User Interface

\[intlink id="946" type="post"\]\[/intlink\]

. The rule is simple: A proper user interface sets the user up to succeed. By this I mean that if the site requires certain information, or information in a specific format, that should be clearly indicated in the user interface. A site, or any application, should make it clear up front what is expected, as opposed to indicating what the user should have done only upon a failure to do so. Tightly coupled with this is my “Second Rule of User Interface”: Don’t fight the user’s habits. If the first rule could be paraphrased as “Tell the user what you expect”, then second rule could be said “Don’t deny what the user expects.”

This rule comes into play in many ways, from where navigation elements should be located, to how buttons and links behave. It also means that you shouldn’t “break the browser” by attempting to disable JavaScript features (such as Control+Clicking or Right+Clicking on an element), preventing use of the back button, and so forth. This last issue—wanting the user not to use the back button—is a big mistake. (And keep in mind that most attempts to circumvent common browser behavior can be easily circumvented by disabling JavaScript.)

Time Flies: Flex Book Update

For those of you that read this blog regularly (-ish), my apologies for the lack of posts last week. I’m continuing to work my way through my new book, “Effortless Flex 4 Development,” and it’s taking up all of my time. But I’m over two-thirds of the way through the book now, having just completed the second section. That’s the heart of the book, focusing on data and communications. The last third of the book will be written over the next couple of weeks. It covers “finishing touches” types of concepts, such as styling applications, effects, using popup windows, and so forth. These will be shorter chapters and involve information that you wouldn’t necessarily use on every project.

I believe the book will be published in July. The list price is about $45 (US), but you can normally get books for much cheaper than that. Amazon currently has it at $33.44. You can also read the book as I’m writing it via Safari Books Online.

C++ Development Tools

When I wrote my C++ Programming: Visual QuickStart Guide book back in 2005 (with co-auth0r Andreas Signer), I had to decide what software to recommend for C++ beginners. As with most languages, full-time experienced programmers may like serious, complete tools, or commercial products, but I often find that software on that level can provide too much of a learning curve for someone simultaneously trying to learn a programming language. What I like to recommend in my books is software that’s approachable, reliable, and, preferably, free. So, for the C++ book, I recommend Bloodshed’s Dev-C++ for Windows.

At that time, Dev-C++ was more or less a standard for beginners (and it was free). I used either version 4 or the beta of version 5 for the book and for years readers seemed to be fine with Dev-C++. Now it seems that either Dev-C++ is no more or just not a good enough option. The Dev-C++ Web site is down, although I don’t know yet if the site is down for good. You can still download Dev-++ from Sourceforge, but it’s the five-year old version.

I’m Not Trying to Sell You a Car

My series on Learning the Yii Framework has been getting plenty of attention, largely, I’m sure, due to the fact that the official Yii documentation references it first, being “best suited for people who just start with MVC and/or Yii programming”. Most of the comments I’m seeing are just complimentary or are asking for assistance in getting something to work. However, I’m getting a few questions along the lines of “Why should I use Yii?” and “Is Yii better than XXX framework?” I guess these are natural questions, but here’s the thing: I’m not a car salesman. I have absolutely no interest in convincing people to buy things. This even goes for my own books, which is the primary basis of my income: I’m not going to try to convince anyone to buy my books. I just don’t have that gene in me. Make no mistake: I would like you to buy my books (multiple copies of each, preferably), but I want you to buy my books because you want to, and because they’re good books, not because I’ve talked you into it. This is true for hiring me to do work. I’ve always had a policy that I wanted companies to hire me again for future work because they want to, not because they have to (tangentially, a hallmark of a good application is that anyone qualified could step in and work with it; I don’t handcuff the client into bringing me back in for any future changes).