A Taste of Insecurity /  by Paulo Fierro

This weekend marks the 25th Taste of Cayman — a food and wine festival put on by the Cayman Islands Tourism Association (CITA).

This year you can buy the tickets online on their site built by Netclues. However, the purchase process is entirely insecure. Taking customers' credit card details in this manner is both irresponsible and unprofessional and it also violates the Payment Card Industry's (PCI) Data Security Standard requirements to protect cardholder data (point #4). I'm no lawyer but I believe if the card details were to fall into the wrong hands they would also be financially liable.

I tweeted at CITA and Netclues but they didn't reply.

When we help clients build anything, be it a site or an app it falls on us as the designers and developers to educate and inform them about issues like this. I am appalled that the people in charge of developing this site would roll out a payment solution without something as basic as an SSL certificate in place — trying to visit the tickets page over HTTPS results in a 404 error (page not found).

If a relatively inexpensive SSL certificate is not installed then I do wonder how much care and attention has been put in place behind the scenes to store credit card details in a safe and secure manner. 

Its 2013 — we should know better. We should expect better.

In any case, we are looking forward to attending the event but purchased our tickets the old-fashioned way.

In person.

What lurks on port 7682? /  by Paulo Fierro

I was using Charles earlier to monitor some HTTP requests and noticed that every few seconds a request would show up trying to ping 127.0.0.1 (localhost) on port 7682. This was odd so I did a quick search and found that I had actually tweeted about this approximately 112 days ago — and had completely forgotten.

So if you see this, simply disable the Adobe Edge Inspect extension in Chrome in the Extensions settings.

Let's see if I remember this time.

Creating a simple Sinatra app on Heroku /  by Paulo Fierro

I am a big fan of Sinatra and have been writing a few apps using this lightweight Ruby framework. Deploying them on Heroku is a breeze and painless but I always seem to forget a step so this is more of a note for future me.

I wrote a template that sets up a very basic Sinatra app that outputs JSON — perfect for when I need to set up a basic API for an iOS app. There's no database, so DataMapper is nowhere to be found and there's no tests either, just extreme simplicity.

Assumptions:

  1. you already have a Heroku account and have the Heroku Toolbelt installed
  2. you are on a Mac, though I'm sure its not too dissimilar for Windows folk
  3. You have the Bundler and Shotgun gems already installed

So with that out of the way,

  1. Download the template, and unzip it into your new apps' folder
  2. Navigate to the folder in Terminal and then run bundle install
  3. Check that everything is working by running shotgun. Then fire up a browser and navigate to http://127.0.0.1:9393
  4. Next we need to create the local git repository: git init
  5. Now we add all of the files: git add .
  6. Then we commit them: `git commit -m 'first commit'

Now we're ready to create the app on Heroku. For this example lets call it "myapp".

  1. In the Terminal create the app (the default stack nowadays is Cedar which is what we want): heroku apps:create myapp
  2. Because the git repository already exists, the Heroku toolbelt should have set up a remote for us, but lets double check: git remote -v
  3. Double check that the remotes look like heroku git@heroku.com:myapp.git for both fetch and push
  4. Deploy! git push heroku master

Now if you navigate to http://myapp.herokuapp.com you should see some successful JSON output.

Now go build your app!