Installation is pretty straight forward, but there are a couple of tricks, so here they are in full Technicolor to save you a couple of minutes.

The first thing you are going to need is the right gem, which you can install directly via

gem install rails --pre

I didn’t want to install it as a system-wide gem, so I created a new gemset in rvm like this

rvm gemset create r31

If you are on windows and don’t have rvm, maybe you could install another version of ruby via pik, but I cannot help you with that.

Anyway, system-wide or scoped to a local gemset, after installing the gem you should be able to create your first rails 3.1 project like this

rails new sandbox

If you are on rvm, don’t forget to create a .rvmrc file with your local gemset to make things more convenient. In my case the contents of the file are

rvm 1.9.2@r31

Are we there already? not yet! Rails 3.1 needs a javascript runtime for all the asset magic. You can choose the runtime of your choice, as long as your choice is one of the options here :p

I chose (see update below!) the rubyracer because I’ve heard good things about it lately, but what do I know, just pick the one you prefer and add it to your gemfile. In my case it looks like this

gem 'therubyracer'

And, you know, now you need to bundle it

bundle install --binstubs

And that’s it, now you can do things like

bin/rake -T

Of course you can start the rails server too

bin/rails server

You know the rest of the song.. Now go to http://localhost:3000 and start dancing!

update: i found some errors when using ruby 1.9.2p0, therubyracer and coffescript. I changed to nodejs (just install it and leave the binary somewhere in your path) and things got back to normal

Since your invoices are something you don’t want to share with the rest of the word, all the pages protected by login were securily encrypted and served via https since the first day, and the session cookie was automatically expired when the browser is closed, so the system was pretty safe.

Still, there was a very small chance of someone hijacking your session, if you were using FACTURAgem and you happened to be sharing a public network with a hacker nearby who was interested in accessing your FACTURAgem account. Due to the profile of both our users and our application this scenario was not likely to happen, and we never had any security breach since we launched the product.

However, with the proliferation of public networks and the quick adoption of smartphones, ipads, netbooks and a myriad of always-connected portable devices, we wanted to add an extra layer of security for our users, so now they can safely use FACTURAgem at any place without any worries.

Since yesterday, all the pages in FACTURAgem, both private and public, are securily served via https. Even if you forget to include the “s” when accesing the apllication, our servers will redirect appropriately to the safest version.

For the technically savvy, I will explain the highlights of the process:

note: FACTURAgem is running on an Apache/Passenger/Rails stack. If you are using a different setup, details might be differ, but the spirit is the same.

We had to cover different fronts of the https problem:

Configuring a certificate and SSL virtual host for Apache.

This was already done in our case since the beginning of the project. There’s a lot of information out there about how to do this.

Telling Apache to redirect all the traffic to https

We had to instruct our non-ssl virtual host to redirect all the traffic to the SSL one, so if you type http://www.facturagem.com/help you should be redirected to https://www.facturagem.com/help instead.

This is easily done with:

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Unfortunately, in our case, we had an extra constraint. There are a couple of subdirectories we don’t want to put under SSL, because they are served by an external service that cannot run under https. For those pages, we will not store any session information, so they will not be a security problem. All we had to do is telling Apache not to redirect if the url is in one of those directories

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !.(fictional_directory_name|another_fictional_directory_name).*
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

By doing this, if you try to visit http://www.facturagem.com/fictional_directory_name/whatever you will not be redirected to https.

Making sure we marked the cookie as secure, so we are 100% sure it will never be passed to non-encrypted pages

By setting a cookie as “secure” your browser is smart enough to send the cookie back only when asking for a SSL resource. That way, even if you are browsing unsafe pages from the same domain, the cookie will not be transmitted, so your session is not subject to attacks.

If you are setting your cookies “manually”, secure is one of the attributes you can set. But if you are using session cookies in Rails, it’s as easy as setting an extra parameter when configuring your session cookie.

ActionController::Base.session = {
:key => '_your_application_secure_session_id',
:secret => '11111222312321321321321313213213213213213213213237761223213213213213131231231321321312',
:secure => Facturagem.config.secure_cookie
}

Some things to consider here. If you are changing a live application, as it was our case, it’s a good idea to change the name of the cookie. That way, you are sure everybody is going to be using the secure version. Otherwise, users with a valid cookie would still use the non-secure version in some browsers. By changing the name, you are sure everyone is setting a new cookie and everyone is secure using your site. The collateral effect is you will be signing out all of the users browsing your site, so take it into account.

Also, note how we are using a config variable to set a secure cookie (or not). This way, our developers can work without locally enabling SSL.

Removing any references to http external resources, so we avoid the “mixed content” message in some browsers

By this point everything should be working fine, but if you are using any resources directly by absolute URL (as is the case of external js or, in many ocassions, images referenced from your stylesheets), then you will be having the “mixed content” message and your users will feel something is not right.

Your first impulse can be changing all the “http://” ocurrences in your files for “https://”. That would fix the problem on production, but should any developer work without SSL, she would experience the mixed content alerts.

There is a not-so-known-but-perfectly-fine solution for this. You can use relative network-path references , also known as protocol relative urls. To make a long story short, if you write ‘//www.google.com/jsapi’ it will use http or https depending on which protocol you are using on the current page. That way, you can forget about which schema you are on. There’s a caveat with explorer downloading twice the javascript files (at least until IE8 there was), and if you want more info Paul Irish has it ready for you.

That was it! by following those steps we were able to make our site more secure and it took just some hours to set up. Now you can use FACTURAgem when you need to, without worrying who your neighbours are.

If you are out of Spain, pay attention to @facturagem, because we are going to be launching an international version pretty soon.

Unfortunately, the branch of the plugin I need is not the master one, because this applications runs on rails 2.3.x and the master branch has been adapted to rails 3 already.

I could just download the tar file from github, or I could make a git clone and checkout the branch I wanted.. but it turns out I don’t need to do any of those, because old good script/plugin has an option to checkout a specific branch

script/plugin install http://github.com/rails/exception_notification.git -r 2-3-stable

And I can start coding right away.. and that’s exactly what I’m going to do after publishing this post.

She told me about this brand new tiny company she was starting up together with Agustin Cuenca and some other folks I didn’t know by then, and who resulted to be brilliant. The idea was to be an Application Server Provider and offer products in the later so-called cloud to help small and medium size companies manage their businesses. They would also develop web applications for third parties. And they would do it all using this new toy called Rails, after a successful proof of concept for a real client by Xavier Noria. Regarding project management, they didn’t want to use a traditional approach, but going down the Agile road and use Scrum. The name of the company was ASPgems, where ASP stands for Application Server Provider and “gems” was something related to this Rails thing.

I was very reluctant to join them. Apart from having just landed into a great job position, I had a lot of doubts about the new company. They didn’t have any money, so I would have to cut down my salary and trust the company would eventually make it; they were working remotely, so I thought nothing would get really done; they didn’t have any big clients, and I came from the banking/public sector/corporate world; and to top it all they were using this Ruby on Rails framework and these requirementless agile methodologies.

My first experience with Ruby, some years before, was painful. I had to make some kind of automatic web crawler and I found libraries for doing it both with Ruby and Jython. I didn’t knew any of them so I tried them both. Right now I don’t remember why I didn’t choose the Jython library, but I know why I didn’t choose Ruby. After half a day trying, it was impossible to make the thing work on my windows machine, and all the documentation was in Japanese, so good luck with it. I finally coded my own crawling solution in good old Java and XML.

So you can imagine I was skeptical about Ruby. Then I started to read about Ruby and Rails and I panicked: no static type check, lack of hosting options, poor windows support, opinionated instead of configurable, with a certain disdain for the database layer… my Java instincts were alerting me with a lot of red signals. And then I made “the mistake” of having lunch with Ana and Agustin. They were really excited about the company, they saw a world full of possibilities, and the sense of adventure was just too strong for me to resist. Besides Agustin had been the guy who started Qarana, the best company I had worked for until then. It was just natural for me to join ASPgems.

By adopting Rails as her development framework, ASPgems was making a statement: We don’t care what other people are doing, we want to use the best tools available with or without the support of the rest of the industry. Living up to that statement takes a lot of work. First you have to be sure you are using the best tools available, so you have to be scanning the surroundings all the time to see when it’s time to move to the new best thing. Besides, you have to keep up to date on all the changes and on the new libraries available. And of course in many occasions you will have to be the one building those libraries, because getting there first means no one did the work for you yet. This living on the edge thing can be really time consuming, but things get much easier when you find a friendly community sharing your passion. And in Ruby/Rails we are really lucky on that issue.

Today is ASPgems’ fourth birthday and I’ve been a part of the company almost from the first month. If I have to judge in terms of personal development, I can say without any doubts this is the best company I’ve worked for, and I guess that’s why I’ve stayed here longer than in any other place before.

Below are some of the things I have done in the last four years. Had I stayed in my safe Java corporate world, I’m not sure I wouldn’t have done some of these things, but I’m sure ASPgems inspired me to do most of them.

I have..

..attended more conferences (and camps, and other events) in the last four years than in the previous 10+ since I started working on IT.
..organized and presented talks in both national and international conferences
..co-started a local ruby group
..curated an extensive online presence: blog, personal page, vimeo, slideshare, mailing lists, communities…
..greatly improved my google ranking, making my conventional CV irrelevant
..written a book

..learnt how to better manage web projects
..seen clients really happy to see their projects going live on time
..shared my knowledge with both clients and competition
..launched more web applications than I can remember

..taught ruby on rails
..introduced some friends to the Ruby on Rails/Agile world
..developed a taste for being an early adopter on new technologies
..adopted ruby on rails for my personal and freelance projects
..switched to linux
..bought several domains and rented my own VPS

..learnt about SEO and Analytics
..made websites scale, and learnt a lot during the process
..learnt a lot about IT (web servers, process monitoring, system set up and configuration…)
..improved vastly my skills on client-side web developent
..been wrong many times, and happy to learn from those mistakes

..helped to build one of the most solid development teams I have seen
..worked together with the commercial department, and not against it

..kept in contact with brilliant developers from all over the world
..started repositories in github and rubyforge
..collaborated in several open source projects

..realized money is just a secondary motivation

Happy birthday ASPgems, and thank you.

p.s. By the way, remember how skeptical I was about Ruby? I was wrong, and happy to be. Go try it by yourself!

SEO is left many times on the hands of the marketing team, but there are many technical aspects that are important in order to make a site appealing both for visitors and searchbots. Since web technologies (and search engines) evolve quickly, if you want to have a good site you need to keep posted about the latest developments. Sadly, there are a lots of materials based on outdated information and there are many myths and legends around the topic

I have been following closely the status of web crawling and indexing for some years, and we have been applying with success many of the practices I’ve learned to improve the sites of some clients. None of these practices involved links from external sites or bought traffic, just a better structure and changes of the contents and the sites’ internals.

Since we want to follow these practices in all the projects we are taking, I decided to prepare an internal training session for the ASPgems’ development team.

Here are the slides for my presentation. Even if they are not as good without the explanation (sorry, no video this time), I hope you’ll find them useful. UPDATE: video -in Spanish- has been uploaded to the media page of my blog.

This material is published under a Creative Commons NonCommercial-Attribution-ShareAlike license 2.5

If you find it interesting or if you are going to use it for any purposes, I’d appreciate an e-mail to jramirez@formatinternet.com

My talk was a reflection about web development and the relative importance of the development tools. I was defending the idea of the individual with good practices being much more important than the choice of a tool or another. I was also talking about why Ruby on Rails is very appealing for such an individual and why it’s still relatively hard to find companies using modern techniques in development.

I talked about which were the best practices I consider an “ultimate developer” should embrace, linking it to concepts found in geek literature such as The Mythical Man Month, The Cluetrain Manifesto, Microserfs o The Soul of a New Machine.

This material is published under a Creative Commons NonCommercial-Attribution-ShareAlike license 2.5

The video is divided in two parts:

This chat is following the polling pattern, issuing an Ajax call every three seconds to check for any updates and receiving a JSON array with the pending messages, if any. Using prototype.js the code to call the javascript function every three seconds is this

new PeriodicalExecuter(Aspchat.chatRemotePoll, 3);

On IE the chat was initialized properly, the first call to the remote server was working fine, but the periodical poller was not issuing any further calls. At first I thought the problem was on PeriodicalExecuter, but after a bit of debugging I could see “Aspchat.chatRemotePoll” was being called, but the Ajax call inside was apparently ignored.

To make things more interesting, I could see some other Ajax requests were working fine (for example, the one to send messages or to update the user list).

Comparing the requests that were successfully sent with the ones that were ignored, I could see the difference. In the working requests I was using POST (the default when using prototype) but in the ignored calls I was using GET.

Once I saw this, it was easy to diagnose what the problem was. IE was caching the GET requests, even when using AJAX. To be honest, this time I will not even blame IE, since I understand a GET request is subject to cache. In this case, I would even say I prefer the IE behaviour over that of Firefox and Chrome.

There are basically three things you can do to prevent this kind of behaviour:

• The easy way out would be to convert my GET request to a POST one. Alas, I didn’t want to do it because in this case I was being RESTful and I was using the same URL for two different actions. When calling “/aspchat/messages” via GET I’m asking for new messages, but when calling via POST I’m sending a new message to the channel.
• Set HTTP headers to control client cache
• Make the request unique by adding a timestamp (or similar) to the URL

The solution I like the best is the one with HTTP headers, so I just went to my poller action (which by the way is managed via a Rails metal middleware) and added the Cache-Control: no-cache header. Just to be really sure, I also added the timestamp for extra security.

The prototype for the Ajax call with the timestamp looks like this

new Ajax.Request('/aspchat/messages', {
           parameters: {timestamp:new Date().getTime()}, //we need this to avoid IE caching of the AJAX get
           method: 'get',
           onSuccess: function(transport){
               Aspchat.displayChatMessages(eval(transport.responseText));  //pass the JSON array to displayChatMessages
                         }
       });

As an extra ball, you can see how I’m using the onSuccess callback to interpret the JSON I’m receiving from the server.

Now you cannot say you didn’t know your AJAX requests could be cached. Let’s be careful out there.

Since I had run an update some days ago, I was blaming some new version of one of the installed plugins.. but I was wrong.

Today I read this post where it explains how to fix it. It’s a conflict between Eclipse and the latest versions of GTK+. By setting the GDK_NATIVE_WINDOWS variable to use native windows, everything is back to normal.

And they lived happily ever after (or until the next major release anyway)


global $wp_query;
parse_str($args, $r);
if (!isset($r['current'])) $r['current'] = -1;
if (!isset($r['show_all_parents'])) $r['show_all_parents'] = 0;
if (!isset($r['show_root'])) $r['show_root'] = 0;
if (!isset($r['list_tag'])) $r['show_root'] = 1;


..what I really get is..


global $wp_query;
  parse_str($args, $r);
    if (!isset($r['current'])) $r['current'] = -1;
      if (!isset($r['show_all_parents'])) $r['show_all_parents'] = 0;
        if (!isset($r['show_root'])) $r['show_root'] = 0;
          if (!isset($r['list_tag'])) $r['show_root'] = 1;


..and that’s no good. Fortunately the solution is really simple. Just enter command mode and write

:set paste

Now you can paste in all its glory. When you are done, you can get back to normal with

:set nopaste

So now you don’t have any excuses left to write original code. Get out there and copy the whole internet before I format it!!!

update: I thought this Chrome OS distribution was THE google distro. I was wrong. It’s just someone who used SUSE Studio to make a customized version of Open SUSE around the Chromium theme. With the site being on a google site and the code on a google code repository, I thought this was it, but no.. this distro is totally unrelated to google.

Chrome OS is by now just a bit more than a curiosity. In the meanwhile, you can go and download a non-official distribution mimicking what it could be, but be warned, all you are going to get is an Open Suse distribution with Chromium installed and a blue theme with a cute logo. Hopefully the real ChromeOS will be much lighter and more user-friendly.

Starting the virtual appliance from VirtualBox is easy. You create a new virtual media with the virtual media manager and then a virtual machine using this new media. That should be it. If you leave the default options (64MB) you’ll end up with a really slow boot. I set the base memory to 512K and things are much better.

What will you find in this distribution apart from Chromium? Zip, Zero, Null.. or if you are into ruby, nil.

Truth is, this distribution is a bit too rough around the edges (when it comes to internationalization, even if it ask you for the keyboard settings, it will just ignore them), but being a SUSE, you can install whatever you want. The only thing you’ll need is the root password. Since I’m such a hacker it took me almost no time to realize the root password was “root” (my other options being “sergei”, “larry” and “640Koughttobeenough”.

Once you have root access, you can use Yast for installing anything you might need. Just for fun I installed ruby, rubygems and sqlite3 via Yast, and then rails using gem. I had to run a gem update –system so I could use rails 2.3.4 and I generated a scaffold to see if everything was fine. Well, it was :)

ruby on rails running on google chrome os

Well, even if it was utterly useless, at least I found a cool way of making customized SUSE distros in an easy way ;)