Small Time Criminals

This is awesome.

One, because it’s classically unoriginal in that the crooks were doing exactly what crooks in movies always do: flash cash and get caught.

Two, because it’s a direct consequence of corruption in politics that prevents the United States Congress from ever mandating the use of smartcard/chip-and-PIN-based ATM cards. If the U.S. ever decided to do this, the rest of world would also breathe easier, because they would no longer have to support the pure magstripe-based withdrawal system that only Americans actually need, and which compromises their security everywhere they go to spend money.

New emacs

Ahh the joy of shared hosting, and its supremely out of date packages:

$ emacs –version
GNU Emacs 23.1.1
Copyright (C) 2009 Free Software Foundation, Inc.
GNU Emacs comes with ABSOLUTELY NO WARRANTY.
You may redistribute copies of Emacs
under the terms of the GNU General Public License.
For more information about these matters, see the file named COPYING.

Eyeballing the official archive site (http://ftp.gnu.org/gnu/emacs/), it’s pretty clear just how old 23.1 is:

emacs-23.1.tar.bz2                  29-Jul-2009 21:56   33M  
emacs-23.1.tar.bz2.sig              29-Jul-2009 21:56   72   
emacs-23.1.tar.gz                   29-Jul-2009 21:37   41M  
emacs-23.1.tar.gz.sig               29-Jul-2009 21:41   72   
[...]
emacs-24.3.tar.gz                   10-Mar-2013 22:31   50M  
emacs-24.3.tar.gz.sig               10-Mar-2013 22:31  490   
emacs-24.3.tar.xz                   10-Mar-2013 22:15   34M  
emacs-24.3.tar.xz.sig               10-Mar-2013 22:15  490

So I decided to build a new version of emacs, 24.3, so I can get my hands on js2-mode:

./configure –prefix=$HOME/emacs –without-x-toolkit –without-gif –without-x –without-xpm –without-jpeg –without-tiff –without-png –without-imagemagick –without-xft –without-freetype

I have to admit, when ‘cat /proc/cpuinfo’ reveals 8 cores of this:

Intel(R) Xeon(R) CPU E3-1270 V2 @ 3.50GHz

I’m a pretty happy camper! (Wish I had one at home, though haven’t got a clue what I’d do with it.)

time make -j
real    0m23.641s
user    1m27.747s
sys     0m9.778s

Update: September 1, 2013

I built a copy of emacs 24.3 on a different system, and removed even more cruft from the configuration:

$ ./configure –prefix=$HOME –without-pop –without-xpm –without-jpeg –without-tiff –without-gif –without-png –without-rsvg –without-imagemagick –without-xft –without-libotf –without-toolkit-scroll-bars –without-xaw3d –without-xim –without-dbus –without-gconf –without-gsettings –with-x-toolkit=no –without-sound –without-x

Which gives a configuration like this, which is clean, and good, since I’ll be using it primarily via an ssh terminal:

Configured for `x86_64-unknown-linux-gnu'.

  Where should the build process find the source code?    downloads/emacs-24.3
  What compiler should emacs be built with?               gcc -std=gnu99 -g3 -O2
  Should Emacs use the GNU version of malloc?             yes
      (Using Doug Lea's new malloc from the GNU C Library.)
  Should Emacs use a relocating allocator for buffers?    no
  Should Emacs use mmap(2) for buffer allocation?         no
  What window system should Emacs use?                    none
  What toolkit should Emacs use?                          none
  Where do we find X Windows header files?                NONE
  Where do we find X Windows libraries?                   NONE
  Does Emacs use -lXaw3d?                                 no
  Does Emacs use -lXpm?                                   no
  Does Emacs use -ljpeg?                                  no
  Does Emacs use -ltiff?                                  no
  Does Emacs use a gif library?                           no 
  Does Emacs use -lpng?                                   no
  Does Emacs use -lrsvg-2?                                no
  Does Emacs use imagemagick?                             no
  Does Emacs use -lgpm?                                   no
  Does Emacs use -ldbus?                                  no
  Does Emacs use -lgconf?                                 no
  Does Emacs use GSettings?                               no
  Does Emacs use -lselinux?                               yes
  Does Emacs use -lgnutls?                                no
  Does Emacs use -lxml2?                                  yes
  Does Emacs use -lfreetype?                              no
  Does Emacs use -lm17n-flt?                              no
  Does Emacs use -lotf?                                   no
  Does Emacs use -lxft?                                   no
  Does Emacs use toolkit scroll bars?                     no

Then, I add a few emacs package repositories (from here):

(setq package-archives '(("gnu" . "http://elpa.gnu.org/packages/")
                         ("marmalade" . "http://marmalade-repo.org/packages/")
                         ("melpa" . "http://melpa.milkbox.net/packages/")))

Setting up the various emacs packages goes something like:

M-x package-list-packages

And then just mark/delete the desired packages with ‘i’ / ‘d’ and press ‘x’ to execute the actions.

Django Forms Need To Die

There are so many Web 1.0 holdovers built into it that seriously impede rapid Web 2.0 development.

Example:

Partially saving forms. Good luck with that. You cannot save parts of forms easily, you cannot perform validation on and save individual fields easily. It’s an all or nothing save. Or you have to roll everything yourself (again).

But that’s a whole other point. I don’t understand why web frameworks even care whether or not a whole form is “complete” and “valid” before saving them off to the database? Other parts of the application logic can determine whether all of the data they need is available, and react accordingly. In my case, I just added a is_user_valid() method, which checks to see that certain fields are in fact valid, before letting a user perform certain actions. (Robustness pretty much dictates that whatever processing code you have later on will need to be able to handle incorrect data anyway.)

Why does a web framework make it possible for a user to lose the majority of the things they’ve entered into a form, only because one single field was wrong?

Why isn’t it the other way around? Why doesn’t the framework save all of the form data that it can to the database model backend, and then prompt the user for a correction to the invalid field? Django’s Bound forms are just accidents waiting to happen in the User Experience. I know this, because during development, I’ve seen this, over and over again: You type something in, expect that it was saved (or worse, reload the page), and whoops, everything is gone. How stupid is that?

The design of Django’s form handling puts the majority of data at risk of being lost, due to the minority of data that is incorrect. This is just wrong-headed.

To solve the problem, I’ve been working on AJAX-based form-saving routines, but again, Django just gets in the way, and chokes whenever it sees a invalid input on a form you’re submitting.

Goddamn it Django, don’t worry about the whole form, just save what you can all the time and go for eventual consistency.

Update: The Django docs say this way at the bottom:

“Changed in Django 1.5: Django used to remove the cleaned_data attribute entirely if there were any errors in the form. Since version 1.5, cleaned_data is present even if the form doesn’t validate, but it contains only field values that did validate.”

But this is useless, if you’re using ModelForms. The stupid thing still raises a ValueError.

Update: Ok, it looks like one workaround for this is this one http://stackoverflow.com/a/4631007 which I’ll repeat here:

Before saving the form, just set all of the fields to required = False, so:

Update: Actually, this whole form-processing mess makes me think we’ve forgotten the adage by the late Jon Postel: “Be liberal in what you accept, and conservative in what you send.” Anything that keeps people from redundantly retyping things should be placed above the form processor’s need for perfect data before it will do anything at all with that data.

Damnit, Django: has_usable_password()

Let’s say you have an account that you’ve marked as having an unusable password. The built-in Django password-change forms won’t let you just set an initial password on that account. You have to write a new view to handle the idea that someone who has an alternative authentication mechanism, might also want to set a password on their account if they want to login using a username + password combo locally.

Update: Ahh, there it is: “class SetPasswordForm, A form that lets a user change his/her password without entering the old password.” It’s in the docs after all, but not exactly the principle of least surprise at work here.