Slashdot Mirror

We recently (five weeks ago) switched to a Zencart based storefront. For those who don't know, Zencart is an OSC fork.

Apparently Zencart is much cleaner than OSC, which makes me shudder in fear at the idea of OSC's source code.

I like nice, clean, documented, tested code.

Zencart is a mess. The documentation is close to non-existent, there are no comments, there's no MVC distinctions, we found several major security holes in a code audit before going live, weird little UI bugs abound (e.g. in the admin interface when you edit a customer's addr, you're *forced* to specify his phone number, or you can not proceed), there are places where code chunk A generates SQL, then passes it to code chunk B, which passes it to C, which *LOOKS AT THE SQL* and edits it, then executes it.

With code like this, try editing an SQL query just a little bit, and you get a complaint on a web page with error messages pointing to an entirely different place.

On the "security" topic, I note that once we got a demo of Zencart installed on a testing machine, with the tell-tale URL (<machinename>/catalog), I started noticing that a lot of the phishing spam I was receiving directed folks to <domainname>/catalog...yes, the phishers were using hacked OSC accounts, which they had (presumably) gotten into through SQL injection attacks on OSC.

This is not to minimize the work of the OSC and Zencart developers - either package is a huge improvement over nothing...but if you want to do surgery on the code, it's a disaster. At Technical Video Rental, we need to track individual serial numbers of copies as they go in and out, and we needed to present sets of videos in a certain way.

This work took two pretty darned good software engineers (me and the CTO of the company) about four man weeks.

I'm not going to say something inflammatory and stupid like "I could have written an operating system in less time", but four man weeks is a pretty major investment of time to do something fairly simple like this.

We're doing a lot of interesting stuff with the code base: we've spliced in WordPress for the corporate blog, I'm writing some AJAX stuff right now to allow customers to report problems with their orders from the order status page, etc.

...and the more we hack on it, the more we think "there's got to be another way".

There's a good chance that over the next 6-9 months we'll end up preserving the OSC/Zencart db schema and data (for continuity with the running site), and dumping major components of the package.

To boil it down: I give OSC / Zencart a grade of "C minus". It's like a decent looking house with a lot of rot inside the walls. As long as you're content to never look inside the cabinets or crawlspaces, you're OK, but once you do some poking, or decide to add an addition, you'll realize how much work you've got in store, and you'll start to wonder if you should just buy a new house.

I have no problem believing this.

I run Technical Video Rental, and I've had - literally - dozens of legal threats over the simple fact that I buy DVDs, then rent them out. Despite the fact that this is deeply settled case law, I've gotten everything from a legal cease-and-desist from one firm's CEO (who has a degree from Harvard Law School and was formerly Chief Counsel of the United States Senate Committee on Labor and Human Resources) to a threat to - ahem - anally rape me (from a guy who think's he's anonymous, because he doesn't know what website logs and IP addrs are).

I spend about $2,000 - $3,000 per month on attorney fees trying to explain to people what the First Sale Doctrine is.

This is money that could be spent growing the business, and delivering more interesting videos to my customers...but it gets squandered because so many folks (a) don't understand what the copyright law says; (b) don't understand that exposure increases sales (see also: MP3s and the RIAA).

Bah.

It'd be nice to spend more time doing business, instead of doing meta-business (lawsuits).

Here's where you can rent a video to learn how.

In Hardwired, Walter Jon Williams talked about CNC machines spitting out custom firearms.

It is already the case that one can, with some skill and difficulty, make a reasonable firearm using desktop machine tools.

Sherline, maker of the preeminent hobbyist desktop lathe and mill, is already shipping turn-key desktop CNC machines, based around linux boxes.

Technical Video Rental rents out DVDs on how to build firearms from scratch.

All these trends are accelerating, and about to converge.

In 20 years, no matter what the politicians say, gun control is going to be DEAD.

A linux box + a $1k three axis desktop mill + some scraps of steel + HEAP.sourceforge.net = downloadable firearms.

Josh Tickell also has DVDs on biodiesel, which can be rented or purchased.

I run Technical Video Rental, a small firm that rents out specialized instructional videos (welding, bowl turning, case mods, etc.) and we have a corporate blog.

The reason is two-fold:

1) community for greed's sake.
2) community for its own sake.

To expand on the first: I get lots of email from customers who are anxious to share the details of their metalworking and electronics projects with someone; hardware hacking can be a bit of a lonely hobby. By helping customers share their stories with each other, it gives customers an outlet, and a sense of shared community...which gives them positive associations with the website/service/brand...which keeps them coming back (or at least, adds a very very minor reason to check out the corporate website with some regularity).

To expand on the second: running a small corporation can be a lonely activity as well. One spends a lot of time coding, dealing with customer support issues, dealing with vendors, etc...and not nearly as much time hanging around the water cooler or throwing nerf footballs as one might have done as an engineer. So, putting my
own projects in the blog lets me interact with my customers, which is a nice break from regular work.

I run Technical Video Rental, a small firm that rents out specialized instructional videos (welding, bowl turning, case mods, etc.) and we have a corporate blog.

The reason is two-fold:

1) community for greed's sake.
2) community for its own sake.

To expand on the first: I get lots of email from customers who are anxious to share the details of their metalworking and electronics projects with someone; hardware hacking can be a bit of a lonely hobby. By helping customers share their stories with each other, it gives customers an outlet, and a sense of shared community...which gives them positive associations with the website/service/brand...which keeps them coming back (or at least, adds a very very minor reason to check out the corporate website with some regularity).

To expand on the second: running a small corporation can be a lonely activity as well. One spends a lot of time coding, dealing with customer support issues, dealing with vendors, etc...and not nearly as much time hanging around the water cooler or throwing nerf footballs as one might have done as an engineer. So, putting my
own projects in the blog lets me interact with my customers, which is a nice break from regular work.

I run Technical Video Rental, a small firm that rents out specialized instructional videos (welding, bowl turning, case mods, etc.) and we have a corporate blog.

The reason is two-fold:

1) community for greed's sake.
2) community for its own sake.

To expand on the first: I get lots of email from customers who are anxious to share the details of their metalworking and electronics projects with someone; hardware hacking can be a bit of a lonely hobby. By helping customers share their stories with each other, it gives customers an outlet, and a sense of shared community...which gives them positive associations with the website/service/brand...which keeps them coming back (or at least, adds a very very minor reason to check out the corporate website with some regularity).

To expand on the second: running a small corporation can be a lonely activity as well. One spends a lot of time coding, dealing with customer support issues, dealing with vendors, etc...and not nearly as much time hanging around the water cooler or throwing nerf footballs as one might have done as an engineer. So, putting my
own projects in the blog lets me interact with my customers, which is a nice break from regular work.

• carpentry and plumbing for hire.
• writing a few magazine articles (Dragon Magazine, Fine Homebuilding, other random things).
• playing poker (well, OK, penny stakes: my biggest win has been $2 for an entire night...)
• running a online videorental business Technical Video Rental ("like Netflix for geeks")

I find all of this pretty ironic: what I *want* to be doing is getting back to devel work to implement a client-side ecommerce tool I'm hacking on...

Read Aramis

The book actually kind of stinks. It's got a typical French ooh-let's-look-at-everything-as-sociology angle, which totally obscures the valid political and engineering reasons that the project imploded.

So, maybe, don't read Aramis...but just be aware that this isn't new.

TJIC

Technical Video Rental - like Netflix for Geeks!

An acquaintance criticized spreadsheets and praised pencil and paper forms because mathematical errors can crop up in either one, but with paper there is a double-entry system, running totals, and review by brains and eyeballs.

My argument is that paper is a big step backwards:

1. it's not FTP-able; can not make arbitrary backups
2. it's not mailable
3. one can insert arbitrary figures with out validation
   • line 1 (paying customers): 10
   • 
     line 2 (non-paying customers): 10
     line 3 (all customers; add 1+2): 400

I use a decently large spreadsheet to run Technical Video Rental, and I've certainly found bugs in it, but I've noted that the bugs are denser, and harder to find in those areas where the computation appears with more intermediate values hidden.

I think that a more confident spreadsheet programmer tends to hide more variables in complex cell formula; as I am not a confident spreadsheet programmer, I've - in many places - spread formula across multiple cells...and this has helped me figure out bugs.

This points out running totals as one example of good practice. Nothing could be simpler in a spreadsheet, yet we almost never see it.

So: why do spreadsheet programmers not do these things?

One reason that occurs to me is that spreadsheets conflate calculation with presentation. Intermediate values use up screen real estate, and look ugly.

Yes, there are tools that *allow* one to separate calculation from presentation: one could have two separate tabs, for example.

Yet these tools allow for disambiguation of calculation and presentation in the same way that assembly programming allows for object oriented design.

Or, to rephrase it: "Hidden steps considered harmful".

I don't even like C/C++ code that puts too much computation on a single line: I want intermediate values that I can step through with a debugger.

Perhaps what's needed are much higher level tools with in the spreadsheet that let one select cells of interest on one tab, then create a presentation tab based on these? I've got visions of cool Mac-Aqua-like greying out of 90% of cells, while one drags and drops the still-crisp cells around... Another/alternate idea: it might be nice if instead of the heavyweight tabs that most spreadsheets support, one could open zoom in on a single presentation cell and investigate little "pocket tabs" which might have ~10 x ~10 cells in them. The equivalent in C/C++ would be a complex expression on one line that decomposed itself into multiple lines with intermediate values only when you walk it with a debugger.

Now, don't get me wrong: I'm not arguing for fancy presentation layers, or dancing pie-charts; I'm arguing for the ability to take a huge page of calculations and tie the some of the inputs, intermediate steps, and output to a much smaller summary page, or, conversely, I'm arguing for the ability to take spreadsheets as they are currently written, and expand them into a debuggable format.

This, I argue, would make spreadsheets more useful, and decrease the number of bugs that crop up in them.

Somewhere else on the list (high up, I suppose, but certainly not number one) is to have my code used.

If I could choose between losing my house and having to sleep under a desk in some academic department (I raise this not as hyperbole, but as an example of some more-extreme free-software behavior), or moving into some other field, I'd move into some other field.

I've got lots of other interests, and there are livings to be made in any of those fields.

TJIC - technicalvideorental.com