The Web Design & Development Megathread

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > The Web Design & Development Megathread

«‹›361 »

o.m. 94: Nov 23, 2009

Boner Slam posted:

Yeah that's fine, it's always been like that. Set up a server, set up sql, do poo poo.

I heard somewhere PHP is no longer cool. Though that's why I am asking here, as I can not really confirm the validity of the things I pick up.

As far as the computation is concerned, I know that Python has some numerical packages. I would like to include R at some point probably as well. I read it can input C, so maybe there's a way to interface via that.

What is the difference between a framework like Django and a framework like Symfony? Is it just the same thing for different languages or is there a fundemental difference?

I don't think PHP was ever cool

It's popular, and has improved considerably over the past 10 years, especially if you employ a framework that uses it properly. I guess it's down to preference. The main point is that you should work with something that does all the boring stuff for you (handling users, security, routing etc) so you can focus on delivering your functionality and front-end. Set up a Linux stack, install various options, and get a feel for something. It's mostly preference.

# ? Aug 16, 2013 13:19

Adbot: ADBOT LOVES YOU

# ? May 8, 2024 18:21

Boner Slam: May 9, 2005

Ok though if I wanted to interface with a thing that would have more power to do statistical/numerical computation or optimization or something like that, which would be the most interface-friendly?

# ? Aug 16, 2013 13:23

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Have you seen SageMath Notebook, or its replacement, SageMath Cloud? It sounds to be somewhat similar to what you want to do, and the code for it is open-source.

# ? Aug 16, 2013 13:53

leftist heap: Feb 28, 2013; Fun Shoe

oiseaux morts 1994 posted:

Oh man where to begin. There are a billion solutions to your spec, although the requirement for mathematical computation means you need to get serious.

In the long run, I think it is worth doing the following:

* Get virtualization software like VirtualBox or VMWare
* Install a Linux distribution like Ubuntu Server (should meet your needs and has lots of support)
* Set up a stack. Apache to handle requests, MySQL for database and PHP for your code is a popular example but you could use Django, or Ruby and some other kind of database.
* gently caress around trying out some kind of CMS. Drupal is a powerful choice. It will handle, gracefully, 4 of the 5 requirements you have.
* Decide the CMS is too weird and restrictive and go for a proper big boy framework like, say Symfony.
* Find out a way to integrate your computation stuff with whatever framework/CMS you decide on. You'll want it to be server-side and fast as balls, running on your stack.
* ...
* Profit!

I'm being totally LAMP-centric in my suggestion, there are plenty of other ways to go about this but the most important thing is to take away is that you need a Linux box running a stack. This is what everyone does these days. You can then take your Linux set up, buy some decent hosting (I use Linode, the important thing is to use a provider who just gives you a server with total freedom) and put it live in the same fashion.

To offer a completely different approach if you don't have a hard requirement on something like R right off the bat: start on something like Google App Engine and actually build your application instead of dicking around with stack issues. Then if, you know, people actually use it and you decide that you actually need R or anything esoteric like that, you can shunt that code off onto a different stack that supports it (like AWS or whatever) and keep your main application code on GAE.

Basically, my approach would be to do whatever gets my application up and in front of users as quickly and then worry about things like using R to do complex statistical poo poo. Surely you can live without R at least in the beginning. GAE supports Python and has things like numpy, PIL, matplotlib, django, etc. or if you use Java I think you can pretty much use any library you want.

# ? Aug 16, 2013 18:34

Boner Slam: May 9, 2005

Hmmmmmmmm. Maybe for testing and dummy purposes. But of course then I would not learn how to implement all this for myself, right?
I am not sure which actual data I am going to use for some things yet. This might sound paranoid but I don't want to upload my stuff to a cloud service, especially if it is based in the USA, since that would be technically illegal for me.

# ? Aug 17, 2013 10:45

Lightning Zwei: Aug 7, 2013

So I've been messing around with Ruby/Rails, Python/Django, and asp.net MVC for the past few days and I've decided to stick with asp.net MVC for the time being. I may be an idiot but the learning curve with Ruby seems insane, especially having no prior web development experience. I don't want to be messing around with a command line while I'm still just starting to understand POST and GET. MVC makes more sense to me after working with Visual Studio C++ and JCreator IDE's. Are there Ruby IDE's(clearly I don't get it)?

# ? Aug 17, 2013 16:55

kedo: Nov 27, 2007

Boner Slam posted:

This might sound paranoid but I don't want to upload my stuff to a cloud service, especially if it is based in the USA, since that would be technically illegal for me.

I want to know about this project.

# ? Aug 17, 2013 17:15

Thermopyle: Jul 1, 2003; ...the stupid are cocksure while the intelligent are full of doubt. �Bertrand Russell

Lightning Zwei posted:

So I've been messing around with Ruby/Rails, Python/Django, and asp.net MVC for the past few days and I've decided to stick with asp.net MVC for the time being. I may be an idiot but the learning curve with Ruby seems insane, especially having no prior web development experience. I don't want to be messing around with a command line while I'm still just starting to understand POST and GET. MVC makes more sense to me after working with Visual Studio C++ and JCreator IDE's. Are there Ruby IDE's(clearly I don't get it)?

PyCharm for Python/Django, and while I haven't used it, there's RubyMine from the same developers for Ruby.

Honestly, for a lot of stuff the command line is easier than the IDE, but whatever floats your boat.

To be honest, with your background and if you're still interested in learning something new and we're choosing between Ruby/Rails and Python/Django, I think you'd get on best with Python/Django/PyCharm. That trio offers the most handholding � la Visual Studio.

I also wonder if you're not starting off on too complex of a project.

Maybe do Python/Django and a small twitter clone. That should be possible to learn and do in Django in...I dunno...10 or 20 hours? I don't really know on those numbers, but it would be easy for someone who already knows how to program anything.

Actually, on second thought, if you're coming from languages like C++, you may have a hard time grasping the true nature of languages like Python without some more fundamental instruction than you'll receive in the tutorials for Rails or Django, and you may want to try something like How To Think Like A Computer Scientist: Think Python, before you step up to doing Django.

# ? Aug 17, 2013 18:35

Lightning Zwei: Aug 7, 2013

Thermopyle posted:

I also wonder if you're not starting off on too complex of a project.

I think you may be right and I need to manage my expectations. After all, developers get paid big bucks to design and implement projects like this, it's silly for me to think I can jump in and grind it out in a few weeks.

Thermopyle posted:

Actually, on second thought, if you're coming from languages like C++, you may have a hard time grasping the true nature of languages like Python without some more fundamental instruction than you'll receive in the tutorials for Rails or Django, and you may want to try something like How To Think Like A Computer Scientist: Think Python, before you step up to doing Django.

Awesome link, I will start reading through that now!
Thanks

# ? Aug 17, 2013 23:12

salisbury shake: Dec 27, 2011

I'm converting a personal website from static pages to a barebones blog and client to a text game I wrote in python a few months ago. It's mostly for the learning experience as this will be babby's first web application.

I'm going with python + flask for the game, and that is working out well.

For the blog, I set up an environment with python + flask + peewee. Since this is a domain I'll be linking my personal poo poo to I'm concerned that my hackjob would leave gaping security holes that I would be unaware of. What are some security best practices to be aware of before putting this together?

# ? Aug 18, 2013 20:07

Mrs. Wynand: Nov 23, 2002; DLT 4EVA

salisbury shake posted:

What are some security best practices to be aware of before putting this together?

Unf... there is always so much and it's always changing. Don't put anything too sensitive up, you are likely to gently caress something or other up no matter how hard you try not to. Even at the highest echelons, best you can do is try to be careful, and then code-review, code-review, code-review. More money buys you more reviews by more senior security dudes, and that's how money turns into "security" as far as I know.

OTOH, you are a very unlikely target for a determined, resourceful attacker... good ol' security through obscurity.

Here is my personal checklist of stuff to look out for. A lot of it is 101 level stuff, but that's why it's a checklist, it's easy to forget:

SQL Injection: don't ever do your own interpolation into sql strings, and avoid raw sql strings to begin with when possible.
XSS: Use some auto-escape or string tainting mechanism, in general only put variables into your templates that have gone through some sort of internal model transform (i.e. never ever straight from the current request data).
CSRF: Did you turn on CSRF?
Session safety: Make sure it's a session-id with db backing or encrypted cookie to store user state data.
Clickjacking: Use a frame-escape script.
Server vulnerabilities: (when you are a lone web dev without dedicated admins this is one of the easiest and most common mistakes!) Keep the server's OS and all server software you use (web server, sql, etc) and libraries and framework dependencies up to date for their minor versions. I.e. security hot-fixes. These sometimes have really really bad security holes that can be exploited by automated scripts from botnets as they affect all applications running them, so obscurity won't help you!
HTTPS: Use https for all logins, both the POST action and the login form, yes even you are the only user.
BREACH(New and exciting!) Do not use compression (mod-gzip etc) for your https pages (see above) until frameworks start rolling out long-term fixes for it.

# ? Aug 18, 2013 21:16

fac53: Oct 22, 2002; At last! A dead star!

Newf posted:

Potentially stupid question here:

Why is it that everyone in web design uses hex colour codes rather than rgb? I can't believe that people find it easier to read the hex representation; is it just a convention held over from some time before rgb colours 'existed' on the web?

Using RGB colors in CSS is relatively new and doesn't work in crappy old browsers, which is why most people still use hex color codes or a hex color code fallback to RGB colors.

# ? Aug 19, 2013 02:00

Lumpy: Apr 26, 2002; La! La! La! Laaaa!; College Slice

Stuart McSlim posted:

Using RGB colors in CSS is relatively new and doesn't work in crappy old browsers, which is why most people still use hex color codes or a hex color code fallback to RGB colors.

Plus if you've been doing web development for more than a week, hex is just as "easy to read" as RGB, if not easier. If I was going to replace thinking in hex with anything, it would be HSL.

# ? Aug 19, 2013 04:31

tarepanda: Mar 26, 2011; Living the Dream

Boner Slam posted:

As far as the computation is concerned, I know that Python has some numerical packages. I would like to include R at some point probably as well. I read it can input C, so maybe there's a way to interface via that.

I'm not sure what you're trying to do, but NumPy and matplotlib are both Python libraries aiming (I think) to duplicate/expand on a lot of Matlab functionality, some of which may help you with your mathematical stuff.

# ? Aug 19, 2013 07:30

Bognar: Aug 4, 2011; I am the queen of France; Hot Rope Guy

salisbury shake posted:

What are some security best practices to be aware of before putting this together?

Mr. Wynand covered a lot of the good ones, but I want to tack another one on:

NEVER STORE PASSWORDS IN PLAIN TEXT

If someone manages to get into your server and can access your database, you don't want them having access to all of your users' e-mail addresses and passwords because I guarantee you there will be some overlap. Passwords should not be recoverable in anyway way. This leads me to my next point:

DO NOT ENCRYPT YOUR PASSWORDS

Encryption implies the possibility for decryption, and that's barely better than storing things in plain text when the decryption key is also stored on the machine. What you want is a one-way hash function. A one-way hash "cannot" be reversed (i.e. it is improbable to reverse it in a useful amount of time with today's hardware - barring any errors in the hashing algorithm). When a password is set, store the hash of the password. To authenticate future logins, hash the incoming password and compare it to the one you've stored.

For whatever language you're using, find a widely used implementation of bcrypt, scrypt, or PBKDF2 and use one of those to generate your password hashes.

# ? Aug 19, 2013 14:35

Dietrich: Sep 11, 2001

Is it common to have the client side javascript hash the password and pass the hash rather than the plain text password to the server for verification against the stored hash? With HTTPS you don't have to worry about man in the middle attacks in general, but it seems like that would be most secure.

# ? Aug 19, 2013 15:51

Bognar: Aug 4, 2011; I am the queen of France; Hot Rope Guy

Dietrich posted:

Is it common to have the client side javascript hash the password and pass the hash rather than the plain text password to the server for verification against the stored hash? With HTTPS you don't have to worry about man in the middle attacks in general, but it seems like that would be most secure.

It's uncommon because it's mostly unnecessary and it relies on the different JavaScript implementations of all of your users. Also, things like NoScript and potentially GreaseMonkey can break your client-side hasing. It's best to just rely on standard HTTPS in this case.

# ? Aug 19, 2013 16:21

Mrs. Wynand: Nov 23, 2002; DLT 4EVA

Bognar posted:

It's uncommon because it's mostly unnecessary and it relies on the different JavaScript implementations of all of your users.

I've been using forge for client-side crypto knick-knacks and it's actually quite good. (I do agree what what you're saying though - for sending pws, just do https).

# ? Aug 19, 2013 17:17

Oh My Science: Dec 29, 2008

I have been toying with Stormpath and unless you really want to roll your own user authorization & authentication solution it will save you time and possibly security headaches.

Oh My Science fucked around with this message at 17:49 on Aug 19, 2013

# ? Aug 19, 2013 17:43

Mrs. Wynand: Nov 23, 2002; DLT 4EVA

So, Web Components.

This is more or less a good idea, but wrapped inside several layers of tremendously bad ideas. Components bundling markup, styles and behaviour, sure, yes, good. Typed elements with event hooks, yes, excellent. The "Shadow DOM" idea for having "private visibility" into a widget is also pretty good. Splendid.

But this is the W3C, so let's see, how can we make it loving NUTS? I know, let's define a new templating structure which is applied as a css attribute in your stylesheets. And let's come up with a brand new event wiring method based on the last array literal statement in a <script> block (can't make this poo poo up). Also, let's allow new user elements with their own tag names, but no namespaces because that is so Web 1.0.

# ? Aug 19, 2013 21:33

Thermopyle: Jul 1, 2003; ...the stupid are cocksure while the intelligent are full of doubt. �Bertrand Russell

Hey, W3C, lets make HTML/CSS even shittier.

When I decided to start working on web stuff I spent a few days learning HTML/CSS and DOM stuff and thought "wow, this sure is a lovely system. Well, maybe it's because I'm not as fluent in it yet as I am with the handful of programming languages/frameworks/thingys I think are really nice. I'll give it more time."

Couple years later: "No, this is poo poo."

Glad to see the W3C is keeping it up.

# ? Aug 19, 2013 22:29

kedo: Nov 27, 2007

Mr. Wynand posted:

I know, let's define a new templating structure which is applied as a css attribute in your stylesheets.

The Decorators section of that document is pretty hilarious.

What's even more hilarious is the two named editors on this draft are Google employees.

# ? Aug 19, 2013 22:41

kedo: Nov 27, 2007

Anyone know if there's a way to detect whether or not a user's browser can handle tel: links? Modernizr can't seem to do it, which is a huge bummer.

# ? Aug 19, 2013 22:55

Depressing Box: Jun 27, 2010; Half-price sideshow.

Modernizr doesn't automatically add a class to the body, but it looks like you can check Modernizr.inputtypes (assuming your build has the HTML5 Input Types tests). So something like this:

JavaScript code:

if ( ! Modernizr.inputtypes.tel) {
  // No tel support
}

Depressing Box fucked around with this message at 23:14 on Aug 19, 2013

# ? Aug 19, 2013 23:11

kedo: Nov 27, 2007

Depressing Box posted:

Modernizr doesn't automatically add a class to the body, but it looks like you can check Modernizr.inputtypes (assuming your build has the HTML5 Input Types tests). So something like this:
JavaScript code:
if ( ! Modernizr.inputtypes.tel) {
  // No tel support
}

Sadly that's for inputs, and I'm talking about these buggers: <a href="tel:1-800-YOUR-MOM">Call your mother</a> :smith:

But thanks anyhow!

# ? Aug 20, 2013 00:58

cbirdsong: Sep 8, 2004; Commodore of the Apocalypso; Lipstick Apathy

kedo posted:

Sadly that's for inputs, and I'm talking about these buggers: <a href="tel:1-800-YOUR-MOM">Call your mother</a> But thanks anyhow!

I do this:

code:

$('a[href^="tel"]').click(function(event){
	if( /Android|webOS|iPhone|iPod|iPad|Blackberry|Windows Phone|Opera Mobi|Opera Mini|Symbian|Fennec|Nokia|Skyfire/i.test(navigator.userAgent) ) {
	}
	else {
		event.preventDefault();
	}
});

I suppose I could do something with Modernizr's 'touch' class instead, but that seems like a sidegrade at best. I'd love to hear about a better way.

# ? Aug 20, 2013 04:01

pipes!: Jul 10, 2001; Nap Ghost

Thermopyle posted:

Glad to see the W3C is keeping it up.

W3C: Gradients, drop shadows, and rounded borders, but no vertical centering.

# ? Aug 20, 2013 15:14

Sudden Infant Def Syndrome: Oct 2, 2004

pipes! posted:

but no vertical centering.

Thanks W3C!

# ? Aug 20, 2013 15:15

Count Thrashula: Jun 1, 2003; Death is nothing compared to vindication.; Buglord

Vertical centering is easy!

code:

<center></center>

code:

<style>
  .foo {
    margin: 0 auto;
  }
</style>

# ? Aug 20, 2013 16:25

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Mr. Wynand posted:

Web Components

I can't even figure out what this clusterfuck is talking about half the time.

quote:

To register an event listener with an event controller, the template includes a <script> element. The script is run once when the decorator element is inserted into the document, or loaded as part of an external document.

Decorators can't contain script nodes because they can live ~anywhere on the web~, but their examples show decorators that contain templates which can contain script and the quote above seems to treat them as interchangeable :psyduck:

There needs to be a way to get people fired from the W3C. Or killed. I'm good with either.

I think the Shadow DOM could be used as a namespace only I can't figure out how their examples work. This is going to make inspecting code really loving annoying, either way.

Edit:

code:

.center{
   position: relative or absolute - whatever floats your boat;
   height: something;
   width: something;
   right: 50%;
   bottom: 50%;
   transform: translate(50%, 50%);
}

Munkeymon fucked around with this message at 19:00 on Aug 20, 2013

# ? Aug 20, 2013 18:33

piratepilates: Mar 28, 2004; So I will learn to live with it. Because I can live with it. I can live with it.

Can we just scrap everything web and start over again? Burn HTML, burn CSS, burn Javascript, start over again and maybe it can be done right next time.

# ? Aug 20, 2013 18:49

substitute: Aug 30, 2003; you for my mum

piratepilates posted:

Can we just scrap everything web and start over again? Burn HTML, burn CSS, burn Javascript, start over again and maybe it can be done right next time.

And... the classic:

http://xkcd.com/927/

# ? Aug 20, 2013 18:57

Bognar: Aug 4, 2011; I am the queen of France; Hot Rope Guy

Munkeymon posted:

code:

.center{
   position: relative or absolute - whatever floats your boat;
   height: something;
   width: something;
   right: 50%;
   bottom: 50%;
   transform: translate(50%, 50%);
}

Now if only we could drop support for Internet Explorer.

# ? Aug 20, 2013 19:16

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Bognar posted:

Now if only we could drop support for Internet Explorer.

Well obviously you gotta fill in all ~5 prefixes yourself because I was working from memory.

# ? Aug 20, 2013 19:31

Bognar: Aug 4, 2011; I am the queen of France; Hot Rope Guy

The vendor-specific prefix will work on IE9 (and without it on IE10), but there's basically jack poo poo you can do to translate on IE8 and below. Most browser stats counters put IE7+IE8 at around 10% market share, so we're not ready to drop support yet :cripes:

# ? Aug 20, 2013 19:38

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

I got to use that the other day in a module that only gets loaded in the presence of HTML5's media features. It was a good-ish day :unsmith:

# ? Aug 20, 2013 21:16

ManiacClown: May 30, 2002; Gone, gone, O honky man,
And rise the M.C. Etrigan!

I'm having a slight problem with a pure CSS menu (<ul><li>-based) I'm building. I've got it all working except for two things. First, there's an offset to the right from each parent menu item to each child menu, so they don't line up in a neat stack. That's not so important, though, as the other problem. When I set the submenu <li>s to clear:both, it takes them from being a horizontal layout to a vertical layout (which I want) and makes it so that once I mouse downward off the first item's text� even slightly� the whole submenu disappears. My guess is that once it mouses off the first child element it resets ul li ul to display:none , but it doesn't do that if the menu runs horizontally instead of vertically. I'm sure this is something really simple, but I'm severely rusty on my CSS, as I haven't done any serious web design work in years and I'm using this as something to polish myself back up for an actually-important project.

Code link here

# ? Aug 20, 2013 22:10

Turkeybone: Dec 9, 2006

Hi thread,

I need some assistance in writing a proposal for a freelance webpage with a university. I'm a student in college, major in hospitality and minor in InfoSci.. last year I put together a tiny Java app for one of my hospitality professors -- basically a working demo of a class exercise that was typically done with pen and paper, where students would have to correctly choose what reservations to take and which not to. It worked fine but it was very crude.

This year I said "Well a java thing is pretty clunky, but I've taken some web-design so I can just turn this into an interactive webpage so it'll look nicer and be more accessible." My professor said I should put together a proposal for the university, since it'll just be a flat fee rather than being charged hourly. I thought this would be some "oh I can do some programming just give me like $60, whatever" but when I said this number my professor said "Um, did you mean to say $600? I told my boss (the asst. dean) that it would be between $500 and $1,000, and the university wouldn't really care so long as it was less than like $5,000. :stare:

TL;DR: My $60 "whatever" webpage just became a $600 "University Thing," and I need help in drafting an appropriate and professional proposal for it. I google'd and see there is a variety of templates and contracts, but I've literally never done this before, so I don't know what makes sense. Thanks!

# ? Aug 20, 2013 22:22

Nebulon Gate: Feb 23, 2013

Turkeybone posted:

Hi thread,

I need some assistance in writing a proposal for a freelance webpage with a university. I'm a student in college, major in hospitality and minor in InfoSci.. last year I put together a tiny Java app for one of my hospitality professors -- basically a working demo of a class exercise that was typically done with pen and paper, where students would have to correctly choose what reservations to take and which not to. It worked fine but it was very crude.

This year I said "Well a java thing is pretty clunky, but I've taken some web-design so I can just turn this into an interactive webpage so it'll look nicer and be more accessible." My professor said I should put together a proposal for the university, since it'll just be a flat fee rather than being charged hourly. I thought this would be some "oh I can do some programming just give me like $60, whatever" but when I said this number my professor said "Um, did you mean to say $600? I told my boss (the asst. dean) that it would be between $500 and $1,000, and the university wouldn't really care so long as it was less than like $5,000.

TL;DR: My $60 "whatever" webpage just became a $600 "University Thing," and I need help in drafting an appropriate and professional proposal for it. I google'd and see there is a variety of templates and contracts, but I've literally never done this before, so I don't know what makes sense. Thanks!

Charge more. The full $1000. Welcome to freelance. And beer money.

Basically, you're gonna want:

Project summary
Project features
Timeline for completion
Payment schedule and terms

Make it look nice, no lovely Times New Roman or anything. Other than that, you're set.

# ? Aug 20, 2013 23:28

Adbot: ADBOT LOVES YOU

# ? May 8, 2024 18:21

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Do you guys set this on your new work?

code:

<meta name="viewport" content="user-scalable=no, width=device-width" />

# ? Aug 20, 2013 23:35

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > The Web Design & Development Megathread

«‹›361 »