sourceLair

News and updates from the sourceLair Team

[sourcelair]

Introducing split view and visual status for Git and Mercurial

Coding is not about typing — it is all about thinking. Here in SourceLair we are committed to helping developers think more about how to solve problems and provide solutions, by minimizing distractions and hassles while they work.

Today we are thrilled to announce split view functionality while previewing your HTML and Markdown files. All you have to do is click the preview icon on the right side of the editor. You won't lose any time with refreshing the window, since it gets automatically refreshed any time you save the file you are currently previewing.

Additionally, from today each time you create or update a file it will get colored according to its Git or Hg status; green if it is a new file for your repository and orange if it is an existing file that just got updated. That way you will always be aware if you have uncommitted changes in your project, without toggling the commit message prompt.

Go now to www.sourcelair.com and enjoy previewing your HTML and Markdown files without leaving your IDE, while having clean visual feedback of your project's repository status.

[sourcelair]

Java, Go, PHP execution & Python syntax checking

Today, we are thrilled to announce support for running your Java, Go and PHP code in SourceLair. From now on you can enjoy both syntax highlighted editing, as well as running your files with a single click, in the above languages.

Next, we are extremely happy to ship automatic syntax checking of your Python code. From today, each time you save your Python file, it will get automatic suggestions for improving your code or warnings about pieces of your code that have syntax errors. That way you will be able to focus more on solving problems, rather than loosing precious time to find out the exact line that breaks your program.

Sign into your SourceLair account at www.sourcelair.com and enjoy developing in Java, Go and PHP in your browser.

[sourcelair]

Introducing emmet.io for SourceLair

Our users love coding HTML in SourceLair; they just open up their browsers and start coding in seconds. Another thing that HTML developers love is emmet.io, because it lets them write code efficiently, faster than ever and focus on the creative part of their coding.

We love tools that let developers focus on being creative while coding, so today we are thrilled to release emmet.io support in SourceLair. Start editing your HTML code, type "a" and then hit Cmd + E to expand it to a full anchor-hyperlink tag, by unleashing the power of abbreviation expansion of emmet.io. Select a part of your code and hit Cmd + Shift + A to be prompted for a tag, to wrap the code that you selected. The possibilities are endless and they are available to you, right inside your browser.

Last but not least, we shipped a lot of UI and stability fixes that let you write code in your browser more efficiently and with less hassle.

Don't wait any longer; go to www.sourcelair.com and use emmet.io to develop your HTML5 apps faster than ever.

[sourcelair]

Sublime keybindings and live support

Being productive when coding always has strong relationship with the personal taste of developers concerning the key bindings of their choice.

Today we are introducing the ability to use Sublime Text key bindings in sourceLair. If you are fond of Sublime Text go to your Control Panel and enable Sublime keymap. This will let you use the standard Sublime Text key bindings, when editing your files in sourceLair.

Last, we are pleased to announce that we are giving live support for all users of sourceLair. If you have any issue, question or desire to give feedback when using sourceLair just click on Live chat link on the bottom of the page to start talking with a person of our team. That way you will be able to get immediate response on your issues and give us faster and personal feedback.

Go now to www.sourcelair.com and enjoy using Sublime Text keybindings, while developing your projects, on the cloud.

[sourcelair]

Folder drag & drop from desktop, syntax checking options and more

Here in sourceLair, we strongly believe that the development process should feel totally natural. Many software teams have people in charge of the visual aspect of their user interface, who work mainly with image processing tools and as a matter of fact, they feel more comfortable when they interact visually, with their software. Drag & drop is, most probably, the best example of natural visual interaction with software and today we are taking one great leap forward, towards this direction.

From now on, when using Google Chrome you can drag n drop both files and folders into your sourceLair project, while drag & drop will work the same, just for files, for the rest of the modern web browsers. Copying whole directories with images, or any other kind of files, to sourceLair, now feels more natural; just like the way you used to do it in you traditional desktop applications.

Starting today you can choose for which languages you should get syntax checking. If you feel uncomfortable with having JavaScript and CSS error markers, next to your code, go to your Control Panel and disable syntax checking for the languages you desire.

Last, this week we shipped a lot of user interface enhancements that streamline the usage of sourceLair, by making it more responsive and eye-friendly.

So go now to www.sourcelair.com and feel free to drag and drop whole directories into your sourceLair project

[sourcelair]

Syntax checking for JavaScript and CSS, auto-complete, workspace persistence and more

Two of the most important goals of software development is keeping high level for both code quality and productivity. We believe that accomplishment of both of these goals should be facilitated by your development environment, so as to let you deal more with what you have to; write excellent software. Today we are happy to ship great new features like syntax checking for JavaScript and CSS, better auto-completion and workspace persistence that will lift of your code quality and boost your productivity.

JavaScript and CSS syntax checking

From now on, when you write CSS or JavaScript code on sourceLair, you will automatically get warnings, next to your code, when syntax errors appear. This will let you write better code, since it will point out automatically, which parts of your code need corrections.

Auto completion

Next, we are happy to release an improved version of our auto-complete system for JavaScript, CSS, HTML and Python. To enable auto completion, just open up your control panel, go to Editor Settings and toggle the Auto complete switch, to On. Now any time you press Ctrl + Space, you will get a suggested list of completions for your code.

Workspace persistence

From today, sourceLair remembers which is the last project you opened, so the next time you will log in, it will open up your project automatically for you. Additionally, for each project of yours you get a personal url in the form of https://www.sourcelair.com/workspace/<my-project>, so as to be able to navigate directly on that project on sourceLair. Last but not least, you can use the back and forward buttons of your browser's history to navigate among the projects you have opened up during a session.

Go now to www.sourcelair.com and write better code, faster, while being able to focus on your real goals and stick with your deadlines more easily.

[sourcelair]

Revamped control panel, always-on terminal, more syntax highlighting

With every major release, we put the bar higher and higher and we really enjoy improving our product constantly. Today we are releasing a great load of updates, on sourceLair, which are based on the needs we understand you, our users, have.

Firstly, we have totally revamped your control panel. The control panel is the place where you customize your development environment according to your needs and where you can access and control your personal information. We gave a lot more space to the control panel, thus making it much more pleasant to your eyes and we made your settings much more visual. Starting now you have full visual access to every one of your settings, while choosing the theme that suits you best is much more easy, with the new theme thumbnails.

Next, we made the terminal always-on, for all project workspaces. From now on, each time you open up a project, on sourceLair, you will get a full Linux terminal opened up for you, immediately. Additionally we added syntax highlighting support for Properties (ini) and XML, while we automatically understand the proper syntax highlighting for files without extension that start with a shebang (e.g. Shell, for files that start with #! /bin/bash). Furthermore, from now on, your .git/config and .hg/hgrc files are automatically highlighted, while we will automatically highlight your .conf files as Property or XML syntax, depending on the contents of your files.

Last but not least, today we are deprecating the user workspace, in order to move forward and supply the best service possible for you. The user workspace (or My Files) supplies nothing more than a project workspace, while it lacks all the amazing features that make sourceLair special, like version control, the terminal and more. For that reason you either have to download all your files manually, or ask us for a copy of your files, which will be compressed, encrypted, and sent to you by an automated job.

[sourcelair]

How to deploy your code from sourceLair to DigitalOcean

This is a brief guide about deploying your code from sourceLair to DigitalOcean. It requires you to have already a project on sourceLair.

Steps

1. Put sourceLair public keys to DigitalOcean

The first step is to install your sourceLair public key to your DigitalOcean server. To do that, log into your DigitalOcean server and then run the following command curl https://keys.lair.io/<username>/install | bash

2. Create git and site directories on your server

In order to get our code working on our DigitalOcean server, we will need one directory to keep our files and one to keep our git data. For that reason, we will use our terminal to navigate to our home folder (cd ~) and then create our directories (mkdir app app.git).

3. Initialize empty git repository

Now we will initialize an empty git repository in the app.git directory, by running git init --bare app.git in the terminal.

4. Add a post-receive hook

Now we have to add a post receive hook, in order to deploy the latest pushed code to our DigitalOcean server. We will do that in two steps

i. Create the hook file

echo "#! /bin/sh\ git --work-tree=/home/user/app --git-dir=/home/user/app.git checkout -f" > app.git/hooks/post-receive

ii. Make the hook file executable

chmod +x app.git/hooks/post-receive

5. Add DigitalOcean remote

Next, you have to add a new Git remote in order to be able to push your code to your DigitalOcean server.

6. Push to DigitalOcean from sourceLair

Last, you have to push your code to your DigitalOcean server. To do that invoke the Push to remote dialog and then select the DigitalOcean remote that you created above.

[sourcelair]

The new SourceLair is here

Here in SourceLair, we work every day to make our lives better, through constant innovation. We develop and release new features almost every week, while we continuously fix issues and improve the experience of using SourceLair to develop your projects any time, on any computer.

Today we are excited about releasing the new SourceLair; a re-engineered version of our service from front to back. The new SourceLair ships along with features that will take your development experience to the next level, while augmenting the reliability of our service.

Features

Command Palette

Earlier this month, we released the "Command Palette"; a feature that gives you access to almost any command available in SourceLair. The Command Palette is built inside every aspect of the new SourceLair. You can do almost everything you would like by just hitting Ctrl + Shift + P (or Cmd + Shift + P) and then search with free-text about the action you would like to perform; from starting a new project, to switching the current programming language and committing your project.

Terminal

Developers love using the terminal. We do as well. From today you can spawn a fully-featured Linux terminal, in your SourceLair project. To do so, invoke the Command Palette, type terminal and hit Enter. This will open-up a new Terminal window, attached to the terminal of your project. The Linux environment of your project is already loaded with great development software like pip, npm, coffeescript, gcc and more. Terminal is built into almost every aspect of the new SourceLair. All of the existing actions in SourceLair that needed long running processes to be executed (like git pull and Django's runserver) now use the Terminal so as to let you control them like you would do locally, on your computer (e.g. ).

Search

Search lets people access resources intuitively — driven naturally by their thought. We have integrated search in almost every aspect of our service; from the editor to the branches of your repository or the available programming languages. We improved significantly the searching capabilities of our editor, so as to be able to do more, faster, without having to touch your mouse. Additionally, we enabled search for most resources accessed by the command palette; the branches you checkout and merge, the remotes to which you push or pull, the programming languages for which the editor provides syntax highlighting.

User Interface

Today we are shipping a brand new user interface for SourceLair. We re-engineered our user interface to make more information available to the user, reduce the empty space, while make it more comfortable to the eye. We updated the typography and color palette of our interface and redesigned the curves of SourceLair, in order to produce a gorgeous user interface, without visual distractions, that enables developers focus where they have to.

Keeping a user interface simple is not simple itself; especially when you constantly add new features to it. We are proud to keep our user interface as simple as it was three years ago, back when we first started SourceLair, while making it fit the needs of a vast range of developers; from novice to advanced Django and Python developers. We can promise that no user will feel uncomfortable with the new user interface that we shipped today.

Support Center

Last but not least, today we are gradually rolling out new articles to our Support Center. We want our users to be able to find answers to their questions instantly, in order to eliminate distractions. We have already new articles on support.sourcelair.com that can help you get support immediately on queries you might have. If you cannot find an answer in these articles, you can always contact us at [email protected] and get a personal answer in less than 24 hours.

The new SourceLair is at www.sourcelair.com and lets you develop software effortlessly, anytime, on any computer.

[sourcelair]

Security: Mitigating Heartbleed vulnerability

On April 7th, 2014 the CVE-2014-0160 vulnerability of OpenSSL, commonly known as the Heartbleed bug, got announced to the public. This vulnerability allows attackers to gain access to read the memory of the host and even read private keys of the server. By now, we have no signs that sourceLair has been compromised by that kind of attack.

What we did about this

We take your security and privacy very seriously, so we took the appropriate measures, to ensure that you are safe, when you use sourceLair to do your work:

We upgraded our version of OpenSSL to the one that has the Heartbleed bug fixed.

We restarted all services that were using OpenSSL on our server.

We re-issued our SSL (HTTPS) keys and certificates.

We deleted all user sessions that started before we fixed this issue.

What you can do about this

In order to ensure even more security for yourselves, you can take several measures as well:

Reset your sourceLair password.

Revoke the GitHub access token for sourceLair and then issue a new one by logging-in with GitHub again (your sourceLair password will be needed for that)

We are constantly following updates on this issue so as to take additional measures, if needed, in order to ensure the highest level of security possible. You can follow us on Twitter, in order to stay tuned with our updates on that issue.

Till then you can go to www.sourcelair.com and continue coding on the cloud, relaxed and secure.

[sourcelair]

Sundaygram: Upgrade to sourceLair Pro, using Bitcoin

Developers all around the world, despite their differences, usually share interest for specific fields of the technology world. Bitcoin is one of those fields that has attracted a great amount of developers the last years, which actually grows constantly and almost exponentially.

Today we are excited to announce Bitcoin support for upgrading to sourceLair Pro. We have been watching its growth and continuously increased adoption for a long time, so we decided that letting our users use their Bitcoins to upgrade their sourceLair accounts would be all but a bad investment. Giving as much flexibility as possible to our users, so as to improve their experience, while using sourceLair, is a top priority for us and the way of paying for sourceLair is not an exception for that.

In case you want to upgrade to sourceLair Pro but you only trust Bitcoin for your online transactions, now you can go to sourcelair.com and upgrade your account using your Bitcoin wallet.

[sourcelair]

Introducing the Command Palette

Here, in sourceLair, we always try to augment developers' productivity through constant innovation. We introduce sophisticated new features that borrow behavior and usability from proven technologies, while unleashing totally new capabilities for our users.

One of the features that Subime Text users love is the Command Palette, which gives you instant access to editor commands, through a very simple —yet powerful— text search engine. Today we are thrilled to announce the release of Command Palette for sourceLair, loaded with more than 20 commands that let you manipulate your IDE. Just hit Ctrl + Shift + P (or Cmd + Shift + P on your Mac) and unleash the power of the Command Palette, through your keyboard.

We started re-engineering our whole UI so as to be more consistent with the Command Palette, so today we are also shipping an all-new UI for Committing, Branch checking out and Branch merging. The new Commit message UI lets you enter your commit message summary and body separately. The Branch checking out and merging lets you search through the available branches, thus making this procedure extremely faster and easier for you, especially if you work on a large project that has many branches.

Last but not least, today we are launching status.sourcelair.com, a website where you can check the current status of the sourceLair service and see if everything is fully functional.

Go to www.sourcelair.com and see yourself how much your productivity increases, when not getting your hands off the keyboard, with the all-new Command Palette.

[sourcelair]

Sundaygram; Introducing multi-processing

Boosting the productivity of developers is one of our top priorities, since the beginning of sourceLair and is something that always intrigued us to try to achieve.

Today, we are taking a big leap towards this direction, by enabling multiple processes for our users. That means that, starting now, almost each process on sourceLair (e.g the django server, syncdb, pip install, bower install etc) has its own console tab in the UI, that stays up-to-date with the logs of your process, in real time. That way your Django server logs do not interfere with the output of your Git merge and everything is tidy, in its place. This combined with the always-available live feed of your Django server logs, will take your productivity to a whole new level.

Additionally, today we are rolling out a lot of UI enhancements that make working on sourceLair a much more pleasant and eye-friendly procedure. We strongly believe that the user interface plays a vital role in user's productivity, so we constantly do our best to keep our user interface simple, efficient and elegant.

Go now to www.sourcelair.com and enjoy spawning multiple processes for your projects.

[sourcelair]

Sundaygram; Introducing pip, bower and CSS/JavaScript preprocessors

The last six months, we introduced two brand new types of project; Django projects and HTML projects, each one of those lets you take advantage of the specific features of each platform.

Today, we are thrilled to announce support for Pip and Bower at sourceLair. Installing the dependencies for your project was never that easy; just right click on your requirements.txt or bower.json file and select Install pip dependencies or Install dependencies, respectively, to install them. sourceLair will install your Python dependencies in an isolated environment, dedicated to your project, while your Bower dependencies will be installed inside the directory of your HTML project (as they used to). We are extremely enthusiast about today, since it marks sourceLair as the first IDE to ship with pip integration.

Last but not least, today we are shipping support for some of the most prominent CSS and JavaScript preprocessors. Starting now, you can compile your SASS, SCSS and LESS code to CSS, and your CoffeeScript and TypeScript code to JavaScript as well. To do that just right click on the file you would like and then choose Compile to CSS or Compile to JavaScript respectively.

These are just a few updates compared to what's coming in the next week. Till then, stay tuned and go to www.sourcelair.com and start using your favorite package manager and CSS/JS preprocessors.

[sourcelair]

Introducing HTML projects

Designing a product that could supply maximum efficiency to the developer, while keeping it extremely simple is something that always intrigued us, at sourceLair. Static HTML web apps can be very complex and should be developed easily in a simple and efficient environment.

Today sourceLair introduces one more project type for its users; HTML projects. With HTML projects, sourceLair users get a dedicated web server for each one of their HTML projects and a public URL to view and showcase their work.

Along with that release we are shipping a lot of security and stability enhancements that make developing on the cloud much more secure and reliable.

Go straight to sourcelair.com and enjoy developing, rapidly, your HTML web applications on the cloud, wherever and whenever you like.

[sourcelair]

OpenDevelop 0.2 (command line interface and more)

We closed 2013 with a great release, by announcing OpenDevelop; an open-source software that facilitates code execution, on the cloud, on shared environments. We are really excited about OpenDevelop and we can't wait to let you get your hands on all the features we are planning for it.

Today, we are thrilled to announce OpenDevelop 0.2; a major update to the OpenDevelop software. In this release we are shipping an all-new command line interface that lets you manage your OpenDevelop instance easily, from the command line. Additionally, in this release we are introducing an improved installer, that makes it much easier to bootstrap an OpenDevelop instance. Last but not least, in this release there are lots of bug fixes and improvements included, that make OpenDevelop more reliable. OpenDevelop 0.2 is available for download, as a GitHub release.

Go right away to github.com/sourceLair/opendevelop, download the latest OpenDevelop release and let everyone run code safely on your infrastructure.

[sourcelair]

Post mortem on Tuesday's outage by security breach

On Tuesday, 14th of January 2014, our main application server got hacked by a botnet, which got root access, using SSH to our server. Since the attack wasn’t done by a human and since it wasn’t targeted, we strongly believe that no data was stolen and no data got corrupted. Despite that we took the most strict security measures, we could, to ensure our users’ privacy.

the incident

The security breach of our application server was caused by three main reasons:

we hadn’t disabled ssh login for root

we hadn’t disabled ssh login with password

we trusted our provider’s 12-character long random password for root

The intruder was trying to get access as root at about 04:00 GMT, while it managed to gain access at about 09:00 GMT. After gaining access, the botnet touched some of the system binaries (like ls) and deleted private-key files. The lack of monitoring on our auth system, combined with the lack of notifying us on these occasions led us on realizing the incident, after the intruder gained access.

what did we do

When we realized about the intrusion, we immediately took our servers down, completely. Therefore we had to ensure that

no data had been stolen or destroyed

no malicious software should be on our server

privacy of our users would not be compromised

this would not happen again

First, we disabled ssh login for root and login with password for all of our servers. Then, we created a new application server and a new database server and we moved all of our data to these servers and shut down the old server, completely.

Next, we wiped out all the sensitive data that we had. That means that we replaced all of our users’ private/public key-pairs with new ones, we deleted all sourceLair public keys, of our users that had authenticated with GitHub, from GitHub, we revoked all GitHub access tokens and reseted our OAuth Client Secret. Last, we reseted all of our users passwords and replaced our obsolete non-salted MD5 encryption with salted SHA-256 encryption with random 32-character long salts for all passwords.

We didn’t take the least risk of this happening again, so afterwards we replaced all of our server passwords with computer-generated 20 character long random tokens. Additionally we used iptables to restrict access to our database server only from our application server, from within the local network.

what did we learn

The most important thing we learned is that security of our service is and should always be the first priority for us. The truth is that in favor of developing rapidly new features and fixing bugs, we underestimated the potential intruders out there and left some vulnerabilities open, by postponing their solution for a later time-period, because of believing that this would never happen. From now on the security of our service is and will always be our top-priority, since the privacy of our users’ data is the thing we care about most.

The next really important thing that we learned from this incident is that we trust no one that will not try to break into our system. That means that we will take always, all measures available so as not to take the least risk for another breach, in any way possible.

what happens next

We already took all the necessary measures so as to make sure that this won’t happen again.

We continuously roll out new security measures that result in enhanced multifaceted protection of our users personal data. The goal is to run all of user-related actions into isolated containers, within the next month. We have already done great progress on that, since most user-related actions are isolated.

Last, our users have to make sure that they will delete the old sourceLair public key from any server or service that has been put on. Additionally, within the next 24 hours, all of our users, will receive an email informing them about this incident and suggesting them to update their passwords at sourceLair.

We really care about our users’ privacy. As we said before, it is our top-priority. We are really sorry that this happened and we strongly apologize to all of our users for that. We will make sure that such incident won’t happen again.

Here you can find a slightly extended version of this report.