Jack Waugh's Field Reports

Mix

Jack Waugh — Tue, 16 Dec 2008 08:21:44 -0700

Since my most recent report I have done mostly the same thing, coding on the web content management system that is tailored to periodical publication. I wrote the code that sends e-mail to notify subscribers when a new edition comes out. The first client for this tool went public yesterday: Maryland Commons.

However, a few days ago, I took a role in explaining to two new volunteers what's desired of them, which has to do with accounting and business analysis. I received a "thank you" from the director for my write-up on those needs. Several other volunteers offered their services recently, as well. I drove the discussion that resulted in at least a provisional assignment of computers to workers. I got the director to agree to a date to clean up the office so we can seat as many simultaneous workers as possible.

I've started looking into tools and procedures to improve the project management and timekeeping for the organization.

Support for Professional Online Publishing

Jack Waugh — Thu, 21 Aug 2008 08:12:50 -0600

I am working on a software system that can be deployed in web servers for online publications.

The system supports the publication of editions on given dates. An edition contains articles, which can have been written by various authors. Editors can plan the edition up until its publication date and upload the articles in their final versions. From the publication date on, the public can read the edition.

When the public first visits the web site, they see the current edition. If they choose, they can navigate to an index of past editions.

Readers can also see an index of the topics covered. Editors can highlight for the readers, those articles that they think especially worthy with respect to a given topic.

To justify public support via CTC VISTA for this development, let me point out its usefulness for publications covering the problems and questions surrounding the making and carrying out of public policy. Owing to online publishing's lower cost relative to the print media and television, and its better support for reader participation, it can improve the level and quality of democratic participation.

Uploading

Jack Waugh — Tue, 25 Mar 2008 11:35:05 -0600

Readers of these field reports may have some difficulty understanding the reports' contexts if those readers have forgotten, or never knew, the nature and purpose of the organization at which the VISTA is working. So, by way of reminder: I work at the Center for Community Technology Services (CCTS) at the University of Baltimore. We help nonprofits in the Baltimore, Md. area with their IT needs, which mostly amount to putting up web sites. There are two kinds of service offered: "consulting" and "development". The "development" division uses Ruby on Rails to implement the client's web site. The "consulting" effort involves talking to the clients and helping them assess their IT needs, and advising them about solutions. Some of the clients are neighborhood associations. Two examples are the Greater Homewood Community Corporation and the Historic East Baltimore Community Action Coalition. Neighborhood associations and corporations help with education, the physical beauty and safety of their communities, and generally various aspects of making their community strong and the life there good for the residents. Another client of CCTS is the Baltimore Urban Debate League. A person who is involved with that told me that he took his teen-aged children to one of the events where the members of the debate league meet the public and display their abilities, and the children thought that since the debaters were so knowledgeable and smart, that they must have come from privileged, wealthy families. Of course, the opposite is the case.

I finished (at least well enough for a few examples tried) implementing the upload into our generic Content Management System (CMS) of documents saved in HTML from Microsoft Word.

I started prototyping a design change to the CMS that would allow multiple components to be collected and stored for a page, to be displayed in some format. For example, the format could call for a photo at the top with a caption to its right, and the main text below. Our prior design would handle components (such as a sidebar) shared among many pages, but the version I was working on would work well where for instance many pages have photos and captions not shared with other pages. Due to changing priorities, I had to suspend my work on this subtask and turn it over to a colleague.

Now I'm looking into uploading a broader class of HTML documents than the CMS could take. This will help clients who need to post documents in a freer format. For example, the CMS would not allow tables within tables.

At the same time, I'm learning some of the changes with Rails 2.0.2.

A Little Markup Language

Jack Waugh — Fri, 22 Feb 2008 06:38:15 -0700

Up until yesterday, the design for CCTS's CMS called for using the Textile markup language for the contents of a "block" element (i. e., a paragraph, heading, list item, or table cell). And in fact that's implemented in our code. However, thinking about how to import documents exposed problems with using Textile. So we decided to have our own little markup language, and I took on to implement it.

*strong*
_emphatic_
[link text: link-URL]
\[\]\*\_\\ quoting of characters that would otherwise signify in the notation.

Menus and Uploads

Jack Waugh — Wed, 13 Feb 2008 23:54:10 -0700

I implemented the "main menu" for our CMS. Nine rules determine which pages the menu indexes when a given page is being displayed.

Currently, I am working on the ability to import HTML files exported from Microsoft Word (even though everyone should switch to OpenOffice.org).

Still Working on CMS

Jack Waugh — Wed, 23 Jan 2008 11:46:26 -0700

I am still working on the CMS.

I am investigating how we can accept uploads of Microsoft Word documents and extract the content from them to convert to our format.

Most recently I contributed some test cases to the tests that get run repeatedly to defend against breaking the code.

In my last report, I didn't say what areas of the code I was contributing on. Since the previous report to that one, I have worked on the editable pages. I also added code that lets an administrator compose their own menu, and code that generates a menu automatically based on the context of a page within an hierarchy of pages. I added the code that lets the administrator choose from among a few predefined layouts for a given page (this choice being inherited, by default, by the page's descendants in the hierarchy), and choose the menu and sidebar for a given layout to include.

I posted at http://lambda-the-ultimate.org/node/2606 a comparison of programming languages Smalltalk and Ruby.

Continuing

Jack Waugh — Mon, 26 Nov 2007 16:10:01 -0700

I'm still working on the generic CMS.

CCTS appears to be asserting a copyright in the entire CMS code. I'm not saying that necessarily goes against VISTA goals or my own. Ownership of the code may be an important part of their leverage for getting paid by clients, and getting paid is what makes it possible for CCTS to continue to serve (and perhaps even grow in capacity to produce more benefit per year for clients).

Although the CMS will have a generic or reference copy, CCTS may make customized versions of it for specific clients. This is where using Ruby on Rails (instead of PHP, as Drupal uses) as the underpinning may pay off, I suspect.

The Rubaiyat of MATSUMOTO Yukihiro

Jack Waugh — Wed, 31 Oct 2007 12:09:47 -0600

I am participating in the development, in Ruby on Rails, of a generic Content Management System (CMS) and a library that lets administrators edit documents that use styles and can be displayed to the public (or a smaller audience) over the Web. My current task is to make sure that when a server using this library exchanges the identifiers of documents and components with the browser, it encrypts the identifiers so that no user can falsify her right to see and edit those documents and components.

Am I the only CTC VISTA who uses the Ruby programming language?

The rest of this posting could be regarded as an appendix for those who want to look in some depth at what I have done so far.

I attach code that unit-tests a module I wrote to encrypt and decrypt IDs. The testing code uses a package called "rspec", that promotes a style where your testing code is also a description in almost plain English of what the module under test is supposed to accomplish from the viewpoint of its callers.

Here is some explanation about the code I attached.

I wrote a class called CapabilityKey. An instance is a randomly chosen key that can be used to encrypt and decrypt identifiers. The code reflects my use of a jargon that refers to an encrypted identifier as a "capability", because, when you (a person or a process on some computer) have it in hand, it denotes your capability or right to access or edit some resource. This jargon occurs in the literature.

In this context, the type of an identifer is simply integer, and it is what is stored in the database to identify the records representing the resources we are protecting. The simple and naive way to identify the resources in interactions between the server and the browser would be simply to send the id.

Maybe I will rename the class as CapabilityLock because a lot of what it does is make sure that the "capability", when used actually as a key, fits the lock, that is, is valid in the context in which someone is attempting to use it. Really, the term "key" refers better to the capability than to the thing I called a key in this code, which is really more the lock. In fact, some of the literature about capabilities refers to them as keys. They function very much like a car key. You shouldn't be able to drive a given car anywhere unless you have the key.

The testing code that I attach refers to the fact that my class or one of its instances should satisfy the following "shoulds", each of which I now try to make a little plainer as to its meaning than the code does:

it "Should support instances being marshaled."

This means that the regular "marshaling" facility included with Ruby should be able to save off a representation of an instance of my class to a file and should be able to correctly recover a usable copy from such a saved copy.

it "Should supply a capability that is a string."

This means that when we give an instance an identifier and say we want back an encrypted version of that identifier, the data type of the resulting "capability" should be String.

it "Should recover the correct id and tag from a valid capability."

This says that when I give an instance an identifier and ask it for a capability, and if I give the same instance back the capability and ask it for the id that that capability denotes, it should give me back the correct id. (Another piece of data, a "tag", is also tagging along with the id in these operations, but we don't need to get into that here).

it "Should detect invalid capabilities in the vast majority of cases."

This test case is an attempt to see whether it is, as it should be, very unlikely that someone dinking around could generate some string that would look like a valid capability to the lock. The way I test that is by creating 1000 locks and trying one key (or "capability") in them that they didn't generate, but that another lock did generate. Each creation of a lock uses the pseudorandom number generator to determine the characteristic of the lock. I consider this test quite equivalent to generating 1000 keys at random and testing them in one lock, although I am really doing the other way around. So, it's at least some way to give confidence that the wrong key won't fit the wrong lock, and this in turn gives some confidence that it would be hard to carve a key and get it to work in a given lock. No doubt a cryptologist would say that such a test is far from perfect. The cryptologist could argue, for example, that for all she can tell from the test cases, the locks might be generating capabilities that all begin with "foo", and the locks might be accepting any string starting with "bar:" as a valid capability, for example, "bar:33" as a capability to ID=33. Testing can't test everything, when it comes to cryptographic strength. But this test at least gives some rudimentary indication that the locks won't take each others' keys.

First Code Change

Jack Waugh — Thu, 18 Oct 2007 16:59:35 -0600

Up until a couple of days ago, one could have said that I was just reading and learning and trying to catch up. But then I submitted my first change to the body of code that the organization maintains, and closed my first ticket. So, even though the code I contributed is trivial, I have officially produced something.

Housed Locally

Jack Waugh — Tue, 16 Oct 2007 09:11:23 -0600

I now have a place to stay in Baltimore. So that's a relief; I shall enjoy shorter commute times, no more time consumed in househunting, and less ongoing expense.