Showing posts with label twitter. Show all posts
Showing posts with label twitter. Show all posts

Saturday, August 14, 2010

Google never removed Oracle from its index

Some folks have been reporting a strange behavior assumed by Google after the lawsuit filed by Oracle against Android and Google: it supposedly removed oracle.com pages, and all the pages that talk about Oracle, from its search index. Even the wikipedia page on the Delphic oracle.
I initially retweeted the news and explained that it was a trick shortly after.
It would have been a low shot, really. I don't think it's even possible to remove that large set of results on all the datacenters of Google in a short time frame.

What really happened
Someone made up this query:
http://www.google.com/search?q=оrаcІе
Initially the result page was empty (Your search - ... - did not match any documents).  Then people began tweeting and sharing the query and Google started showing up them as the unique results:


So how did they do it?
At first I thought someone used a capital i (I) to substitute the L of Oracle, but Google is smart and would perform a case-insensitive search in this case:
http://www.google.com/search?q=oracIe

Nevertheless, the difference between capital i and lowercase L is not so visible in Google's font.
But, if you try to paste the link or save the page and go over it with hexedit, you'll notice this:
http://www.google.com/search?q=%D0%BEr%D0%B0c%D0%86%D0%B5
This is clearly the sign that someone has inserted non-ASCII characters in the query.
The character table for Unicode/UTF-8 says that we have, in sequence:
CYRILLIC SMALL LETTER O
LATIN SMALL LETTER R
CYRILLIC SMALL LETTER A
LATIN SMALL LETTER C
CYRILLIC CAPITAL LETTER BYELORUSSIAN-UKRAINIAN I 
CYRILLIC SMALL LETTER IE
This combination of characters is very unlikely to be found in actual documents. In fact, at first it did not produce results. Furthermore, in Google's font of choice, Arial, the difference between these letters and their latin counterparts (if there is any) is again not clear to the naked eye. It makes sense to reuse glyphs that are actually the same in ordinary printed text.
And finally, the forgery replaces the majority of the latin letters, because replacing only one or two would lead to a Did you mean: oracle notice.

Mystery solved
So UTF-8 struck again, and some of us were fooled by a ingenious, well-forgered Google query. Technically this is called an homograph attack.
The potential of UTF-8 as a dangerous mean of fooling users is great - imagine if non-latin URLs will become a reality. Fortunately, the ICANN and major browsers have been working on a solution, but we as web developers should be aware of the problem too.

Friday, November 06, 2009

How to not test controllers

Yesterday on twitter a discussion started about how to properly design Zend Framework action controllers to allow simplicity of testing, specifically how to inject collaborators in controllers and to avoid breaking the law of Demeter.
The example problem is how to get a reference to a MailService instance for executing this code inside a controller:
$user->sendWelcomeEmail($mailService);
where $user is an istance of the User entity class, thus having no injected services and requiring one to be passed as an argument to the function. This problem was proposed by @apinstein.
I can think of several solutions, and others have been proposed by @beberlei and @weierophinney.

1. Just inject the MailService in the controller: it should ask for the collaborator in the constructor (@mhevery)
This would be correct in Java and it is an example of pure design, but in Zend Framework constructor injection is not available for controllers. They are required to have a no-arguments constructor: this contract leads us to the next solution.

2. Controllers may not have constructors, but there are still ways to inject services/models (@weierophinney).
3. Yadif allows to inject #zf controllers.(@beberlei)
Yadif is a dependency injection framework for php that implements setter injection. Using Yadif in conjunction with setters prepared on the controllers let you unit test them as you can call the setters in test code to pass in stubs and fake objects.

4. Instance the collaborators as bootstrap resources and leave them hanging there waiting for the controllers to use them.
The bootstrap object acts as a service locator. If I understand this process, and we want to unit test the controllers, we should avoid a service locator as it involves breaking the Law of Demeter (getting the bootstrap object only to get the collaborators), and we would have to prepare the container only to put in services, without the Api of the controller telling us what collaborators a controller depends upon.
Also instancing services that might not be used during every request can be expensive. I don't know if there is a lazy loading capability for bootstrap resources. This option is the worst for testing and maintenance.

5. Push down the logic in the model layer (me)
Controllers in Zend Framework are meant as a thin layer over a large domain model one. There is no problem for me in not having easy injection in them because I would put in the controllers only wiring code, which receives the main factory from the bootstrap, request it to create the domain services which have to do the real work and pass request parameters to them, assigning view variables as a side-effect.
$repository = $this->application->factory->getUserRepository();
$user = new User(...); // with a factory if you prefer
$view->message = $repository->registerUser($user);
I know this is breaking the Law of Demeter, but the point here is that if the controller is a thin enough layer, which contains no logic, there is no need to unit test it, and experience the pain of preparing stubs that return stubs that return stubs. This code will be exercised in integration tests that have all the same bootstrap, stubbing the main factory to provide fake collaborators only where they are not practical (a fake MailService in this case).
Here are the reason why I like this approach to controllers:
  • reusability: controllers code is not reusable, to the point that it is suggested to move much of it in helper classes. I do not want to rewrite logic in different places, so it's better for me to keep business logic in the domain layer.
  • simplification: if the controllers are dumb and expose the underlying layers as-is, that would be no translation between the domain model and the end user mental model. The entities presented in the user interface will be the same that live in the domain layer.
  • testing: mocking an array of domain parameters is simpler than mocking request objects. Obviously unit testing is performed only in the domain layer.
  • abstraction: logic is not technology dependent. If you keep logic in the controllers, you are coupled to Zend Framework, while a domain model is agnostic on every other component of the application, isolated by interfaces. It's like using a DataMapper instead of an ActiveRecord.
I avoid so much smart controllers that I recently started to implement the Naked objects pattern, where controllers are generated and delegate all the work to the domain model.

In conclusion, I think you should consider all these five practices for improving your controllers design and make sure your business logic is well tested. Choose the solution that works for you.

Friday, September 04, 2009

Twitter virtues and vices

After some weeks of Twitter usage, I came to the conclusion that it's a good networking tool and I do not regret opening my account. Some technological faults however are preventing me from fully enjoy the experience.

Rapid conversation: +1
Communicating via twitter is like sending phone text messages: the conversation flows and there is a need to rephrase to get to the point quickly. Shortened words and messages are normal as in informal sms communication.

Following @weierophinney: +1
It is often said that people who get things done have no time to tweet, but it seems that Twitter does not kill productivity if used correctly. And if it's the lead developer of Zend Framework, it must means that it's more a matter of choice: reserving a bit of time once a day to answer questions and to formulate ones it's not an action that will kepp you from doing real work. In fact, it will kill you if you keep staring at the screen trying to read every new tweet, but it is different from rss: you don't have to check them all.

The space to say what you want: +1
Many times, during the day, I think about some issues or ideas which does not earn a blog post on their own, but must be kept somewhere "just in case". This is pure tweet material and my timeline is full of thoughts which will could become posts or projects, or simply remain there to give evidence to myself that I always triaged Google Reader entries.

Reply system: -1
Whenever you reply to someone, you start a new tweet. There is no association with which one you are responding to, and neither quoting is present.
For instance, if you are replying to a tweet which has been posted some hours ago and it's not in the top of the timeline, probably no one will understand what are you talking about. Moreover, replies to other people obscure other tweets which might contain some useful links or information.

Limited web interface features: -1
If you want to improve your user experience, you must consider a third party client. I cannot find how to retweet a link in the web interface (the button might be somewhere) as a Tweet has only two ones: favorite and reply. I don't know what happens when I push the former but a star lights up.

Filtering: -1
The only possibility for searching is a full text one with tags such as #php or @giorgiosironi. This is not a problem since Google works in the same manner. Online filtering is unfortunately not possible: I'd like to simply concentrate my timeline when I consult twitter and I have to read all the noise from people who is replying to someone else.

Summing it up, there are pros and cons to manage a Twitter account. I now think that having one is a good move for enhance your networking, since it's much more simple to contact someone with a short tweet than via email (except when twitter.com is down, but it does not result in a -1 since outages are far less frequent than in the past). If you can tolerate the limitations of a system based on unorganized 160 characters messages, you should definitely register. And if you like this blog, remember to follow me.
Any other panegyric or rant?

Featured post

A map metaphor for architectural diagrams

It is a (two-dimension) representation of a pipe. The map is not the territory , but in software engineering terms they are models of it....

Popular posts