Media Net Link

Culture Shifts

Fifteen years ago, as a member of the Electronic Network Association (ENA), I chaired a session at their annual conference. A forerunner of the Electronic Frontier Foundation, the two organizations had many common members.

My session included many experts in the field of research, collaboration and human computer interaction. The session also included Carrie Tibbs, a middle school teacher from the San Francisco Bay Area that used National Georgraphic Kids Network to teach science to her students. Kids would do acid rain experiments, and then upload their data to a central server, where the results would be compared against results from other parts of the country.

The program was way cool on many levels, teaching the kids about issues on a global scale - from the importance of taking good measurements, to more secondary lessons in collaboration and global ecology.

Note that this was before the Web!

Freeman Dyson was one of the experts asked to take part in the conference, and one of the few that turned down the opportunity. At the time he remarked that computer networking was not his area of expertise. Since then he has realized the potential impact of the computer network, and has recently (1999) written a book titled The Sun, the Genome, and the Internet, in which he speculates on the combined contribution of those three technologies, and their potential for good.

When I noticed that he would be a keynote speaker at the O'Reilly Open Source Conference this year it was a deja-vodooian opportunity that I simply could not miss.

Tim O'Reilly politely asked me to breakfast before the keynote, along with Mitch Kapor and the Dysons, and in a mad rush, we all tried to figure out how to set the context for the panel.

After a quick run through of all the Dyson books, and how they could each provide metaphors for some current issue in Open Source, I noted that there was a cultural gap in my upbringing (my father was 60 when I was born), and that I admired George for archiving his father's and father's contemporaries' works. George's book, Darwin Among the Machines, will be a classic one day, and in it he summarizes:

" We have mapped, tamed, and dismembered the physical wilderness of our earth. But, at the same time, we have created a digital wilderness whose evolution may embody a collective wisdom greater than our own. No digital universe can ever be compleletly mapped. We have traded one jungle for another, and in this direction lies not fear but hope. For our destiny and sanity as human beings depend on our ability to serve a nature whose intelligence we can glimpse all around us, but never quite comprehend.

Not in wilderness, but 'in Wildness' wrote an often misquoted Henry David Thoreau,' is the preservation of the world'."

This year's O'Reilly Open Source Conference captured some of that "Wildness", and I'm just starting to get my hands around it. I'll write about it more fully elsewhere, but for now, imagine a conference where Brewster Kahle is talking about Pedabyte Open Source Servers, Bdale Garbe is sharing his experience with open source space programs, and David Rumsey (my favorite - see davidrumsey.com) is creating a world in which we can indeed, tour the world through historic maps that contain dimensions in political, social, physical, and cultural axes.

So as the paradigm shifts, and we are all wondering about the next great revolution, or business opportunity, let's adjust or time frame slightly and imagine the potential.

Certainly, politics and economics will lead us in one direction, but while we are all trying to make a living, let's try to keep in mind the infinite other possibilities.

For those trying to understand the paradigm shift in terms of computing, Tim O'Reilly and Nat Torkington's presentation slides "O'Reilly Radar" are the best place to start:

http://conferences.oreillynet.com/pub/w/29/presentations.html

Bob Kaehms - Media Net Link

Dealing With Database Differences

One of the common debates in database programming is whether to write your code for a specific type of database (such as Oracle or Microsoft SQL Server) or instead to use a middle software layer to help abstract the logic so that you can use the same application with multiple vendor's databases. Those that want to port their applications from one database to another or who need to write a cross platform application will need to make some design decisions at the beginning of a project or do some research when it comes time to port.

In a recent project at Media Net Link, we decided to provide AthenaRMS, our help desk application, as open source and make it cross platform so that a potential user could use one of the free databases like Postgres or MySQL, or, if corporate requirements mandated, their corporate Oracle database. We chose these three databases because of their popularity and widespread use: MySQL and PostgreSQL are free open-source database solutions that provide varying levels of complexity, while Oracle maintains a strong presence in large business installations. By making it compatible with these database systems we made sure that the product was accessible by as many potential users as possible, from small businesses to Fortune 500 companies. Attaining that level of compatibility wasn't easy, however. During the process we discovered various pitfalls that developers need to avoid when building cross-platform database applications.

The first step in managing code that interfaces with multiple databases is to use a database-independent interface, such as Perl's DBI or PHP's PearDB. Both modules provide a consistent API for database operations, allowing developers to send queries to the database in a standard fashion. For example, in PHP you might have to write code such as:

switch ($DB_TYPE) {

  case 'mysql':

   $dbconn = mysql_connect($DB_HOST,$DB_USER,$DB_PASS);
   mysql_select_db($DB_NAME, $dbconn);

  break;

  case 'pgsql':

   $dbconn = pg_connect("host=$DB_HOST dbname=$DB_NAME user=$DB_USER password=$DB_PASS");

  break;

  default:

   error_out("Unknown database type: $DB_TYPE");

  break;

}

PearDB abstracts away the different databases and provides a simple interface instead:

  $dbconn =
DB::connect("$DB_TYPE://${DB_USER}:$DB_PASS@$DB_HOST/$DB_NAME");

As useful as this is, it does not solve many other problems inherent in cross-platform development. We'll address a few in this article, and how you can work around them.

USING vs. ON

While all three databases support the USING keyword, PostgreSQL and MySQL differ from Oracle in a subtle way. Consider the following SQL query:

SELECT a.id

FROM apples a

LEFT JOIN bananas b

USING (id)

This works fine in PostgreSQL and MySQL, but not in Oracle (which returns the error "ORA-25154: column part of USING clause cannot have qualifier"). The obvious solution of replacing "a.id" with just "id" (removing the offending qualifier) is insufficient -- although it works in Oracle and PostgreSQL, it fails in MySQL, returning the error "ERROR 1052: Column: 'id' in field list is ambiguous".

The solution is to avoid the USING keyword completely and rely on the ON keyword instead. The ON keyword is similar to the USING keyword, except it is more versatile, allowing the user to specify joins based on any column (as opposed to USING, which requires that the specified column have the same name in both tables). Rewriting the above query, we have:

SELECT a.id

FROM apples a

LEFT JOIN bananas b

ON a.id = b.id


SEQUENCES

Often, data within a table needs to be identified using a unique identifer. This allows easier access to the data, as well as allowing the database to optimize accesses. These identifiers are usually generated using sequences. A sequence is a construct that automatically generates a sequential number each time it is accessed, which is perfect for creating unique IDs.

In Oracle and PostgreSQL, the process of assigning a sequence to a table (particularly, to the ID column of that table) involves creating a sequence object in the database and then creating a trigger that accesses the sequence whenever new data is inserted into the table. MySQL, however, does not support sequence objects. Instead, columns can have the AUTO_INCREMENT property, which means that whenever data is inserted into a row, the column will automatically be populated with a value created from within MySQL's internal sequence generator.

Faced with two such different paradigms, how did we manage them both? We took sequence generation out of the database and into the code. Instead of relying on the database to supply the sequence, we created a table which contained two columns: the sequence name and the current sequence value. Whenever we needed to get a new value we would access the table, find the correct value, and increment it. This method does result in a few more database transactions than if we used the internal sequences, but made the code much more standardized.

DATE FORMATS

Date formats are another point of contention among the three databases. While Oracle and PostgreSQL share similar date formats, MySQL uses a format similar to that used by the POSIX strftime(3) library function (i.e. date directives prefixed with a percent character). One way to deal with this difference is to pick one format and use a function to translate to another database format as needed. For example, in the following Perl code snippet the function to_date() accepts a strftime-style date string and formats it based on the current database type, which is kept as a global variable. The returned string is then used in the SQL query:

$DB_TYPE = 'oracle';

$date_str = &to_date("%m/%d/%Y"); ## will be translated to MM/DD/YYYY



$sql = qq{

  SELECT *

  FROM sales

  WHERE sale_date = to_date(?, '$date_str')

};

There are many other small differences between databases that will invariably pop up when developing any kind of cross-platform software solution. By leveraging common language constructs (using ON instead of USING),abstracting out functions (with sequences and dates), and relying on
a common programming language or operating system to move the logic away from the database and into a middle tier, you can reduce redundancy as well as maintain clean, readable code.

For more information, check out the following resources:

A Short Guide to DBI:
http://www.perl.com/pub/a/1999/10/DBI.html

Porting from Oracle PL/SQL:
http://developer.postgresql.org/docs/postgres/plpgsql-porting.html

Geordan Rosario - Media Net Link

Home Network Security

Wireless networking (or Wi-Fi) is everywhere; it's cheap, easy to setup, and convenient to use. But are you running your wireless network access point with its default factory settings? If so, you're leaving your wireless network wide open for anyone to freely use the Internet access you're paying for, for whatever purpose they wish, illegal or otherwise.

Here are some tips for tightening the security of your wireless network. Please note that following the suggestions in this article will not guarantee that your network will be completely secure. It's like the lock on the front door to your house: it doesn't keep determined individuals out, but it does stop casual passers-by from walking in and stealing your property.

So what can someone do once they've gained access to your wireless network? They can use your Internet access for free. They can also use up all of your bandwidth, making your own browsing experience much slower. They can illegally download music, send out spam messages, write anonymous or threatening e-mails, launch hacker attacks, or access any files you're sharing on your own network.

The easiest things you can do to lock down your wireless network are to setup an access list and turn on encryption.

Making an Access Control List
Every computer on a network has a unique identification code called a Media Access Control, or MAC, address. You can configure your wireless network access point to only allow computers that you've approved to gain access to your wireless network. To do this, turn on MAC address filtering and add your computer's MAC address to the access control list. For example, to determine your computer's MAC address in Microsoft Windows XP:


Figure 1: Determine your computer's MAC address

Refer to your product's user manual to find out how to add your computer's MAC address to your wireless network access point.

Turning On Encryption
If you don't have encryption turned on, then any data that you transmit from your computer can be intercepted and read by anyone nearby.









Figure 3a: Without encryption
Figure 3b: With encryption

Older wireless network access points only support WEP, or Wired Equivalent Privacy, which is the original encryption scheme for Wi-Fi. Unfortunately, WEP encryption is relatively easy to break. A newer encryption method, called WPA, or Wi-Fi Protected Access, addresses some of the fundamental flaws in WEP. WPA runs in two modes: RADIUS, meant for larger organizations, and pre-shared key mode, which is more suitable for home and small office use.

If you have a choice between WPA and WEP, choose WPA. If all you have is WEP, you should still enable it; it's better than nothing.

Again, refer to your product's user manual to find out how to configure your wireless network access point's Wi-Fi security features.

Other Simple Things You Can/Should Do
A wireless network access point, by default, broadcasts its availability and identity to anyone within its operating range, which is usually up to 300 feet from the access point itself. The access point's default name, or SSID, is usually the access point vendor's company name (e.g. "LINKSYS") or literally the word "default." It's a good idea to change the SSID to something no one can guess, and to stop broadcasting it to the world. This prevents others from knowing that your wireless network even exists, and even if they suspect that a wireless network is operating somewhere nearby, they'll have a more difficult time guessing what your access point's SSID is. The only person who needs to know this information is you.

Another important, yet easy, thing to do is to change the wireless access point's default administrative password. For example, if you don't change the default SSID (e.g. "LINKSYS"), someone could scan your neighborhood, choose your access point, go to Linksys' web site and download the user's manuals, and get enough information to systematically guess the IP address and administrative account username and password. Once in, they can cause serious damage to your network and to the Internet at large.

A final idea: you can also adjust the coverage area of your wireless network access point. By moving your access point towards the center of the area you want to cover, you can prevent your wireless network from extending to places you don't want it to, like your neighbor's living room. Of course, the usefulness of this depends on how large your home is, how close your nearest neighbor is, etc. Another option is to adjust the power output of your access point. This option isn't available in all products, but if it is, it allows you to reduce your access point's coverage area to cover only the space you want it to.

Designing a More Secure Network
Adding more sophisticated security measures to your home network is beyond the scope of this article. Stay tuned for a future article on how to add more security if you also access your corporate network from home.

Richard Kitamura - Media Net Link

ASP On Demand

We've all seen those IBM commercials that have a bunch of important looking "businesspeople" spouting buzzword mumbo jumbo and sounding important. Most of us just, glaze over and write them off as dealing with topics that do not pertain to the lives of regular people. My favorite is the one with the two geeky looking guys debating over whether or not they should be "On Demand." I find this commercial humorous because IBM is implying that they've discovered some new cutting edge business secret called "On Demand" when in truth they are just referring to a concept called the application service provider or ASP model, a concept that pertains to everyone that uses the Internet.

ASP was the hottest buzzword on the market when the dotcom bubble burst in 2000. Tech gurus would talk for hours on end about how it was the future of software. Once the bubble burst it faded in to the background, forgotten in favor of cost-cutting, layoffs, and off shoring. Now that the tech economy is starting to come back, ASP has leaped back into the spotlight under a new moniker, "On Demand."

ASPs have been around for years in areas outside of the web. A good example of a non-web ASP is a video store. When VCRs first became popular in the home in the early 1980's they had limited usefulness. You could record things that were on TV or you could buy a VHS tape of a movie for anywhere from $20 to $100. Then came the Video Rental Store. This made the popularity of VCRs boom. People would only watch most movies one time so it made much more sense to pay $3 to have it for a day than upwards of a hundred to own it. This is the same idea web ASPs are based on. Much of the software on the market today is very expensive to purchase, install, and maintain. Also, once you have it, it seems like it is almost instantly made obsolete by a new and improved version. ASPs attempt to remove the headache from software use in this situation.

Howstuffworks.com describes the most common features of ASPs as:


We are approaching a time where all software companies will have to consider either offering their software as a service or licensing it to a third party ASP to do it for them. Over the last ten years, we at MNL have been helping companies make this leap by either functioning as the ASP ourselves or creating an ASP environment for our customers. We are actually nearing release on a new web database and email integration product called AthenaRMS that we will be offering as an ASP in the upcoming months. Inevitably, as the "On Demand" movement gains more and more momentum you will find yourself with questions or dilemmas around your own ASP strategy. Please feel free to give us a call if we can help.

Ryan McGredy - Media Net Link