Pivotal Labs

Main menu

Skip to primary content
Skip to secondary content
  • About
  • Case Studies
  • Team
    • Executives
    • Locations
      • San Francisco (HQ)
      • Boston
      • Boulder
      • Denver
      • London
      • Los Angeles
      • New York
  • Community
    • Blogs
    • Tech Talks
    • Events
  • Careers
    • Lifestyle
    • Principles & Practices
    • Benefits
    • FAQ
    • Apply
  • Contact
    • Press Room
    • Press Releases
    • In The News
    • Press Kit
  • All
  • Labs
  • Standup
  • Tracker
Colin Shield

Standup 1/13 Successful completion with SQS Internal Error

Colin Shield
Thursday, January 14, 2010

The RightScale SQS gem returned an exception from SQS multiple times, including retries. Not an unusual event. This could have been caused by the SQS service being unavailable. However, the team noticed that despite the failure the message was actually successfully added to the queue and processed as normal.

ActiveSupport logger appears to open the default ruby logger and remove everything except the basic log message passed through. This is done for all subsequent uses of the logger. Perhaps this is done so that the log message could be passed to a syslog service which will add timestamps.

  • 0 Shares
  • Share on Facebook
  • Share on Twitter
Colin Shield

Standup Jan 12 2010 DateJS timestring parsing

Colin Shield
Tuesday, January 12, 2010

Whilst trying to parse differently formatted date strings from rss feeds a pivot found that date.now is overridden by DateJS to return a new date.
There was a suggestion, that later proved useful, to use google’s rss reader to first clean up the different rss feeds to ensure that they all can be parsed in much the same way.

  • 0 Shares
  • Share on Facebook
  • Share on Twitter
Pivotal Labs

Standup 1/7-8: Bundler, MySql vs Sqlite on disk vs Sqlite in-memory

Pivotal Labs
Friday, January 8, 2010

Bundler 0.8.1 is out. There have been some significant changes around how the vendor directory is organized, so you’ll want to rm -rf vendor/gems and re-run bundle.

A team tried swapping in Sqlite to see if it made any difference in test suite runtime. It was actually slightly slower than MySql. In-memory Sqlite didn’t help either.

  • 0 Shares
  • Share on Facebook
  • Share on Twitter
Pivotal Labs

Standup 1/5: capistrano and bundler

Pivotal Labs
Wednesday, January 6, 2010

A gotcha when using cap and bundler:

“If deploy.rb does a require ‘auto_tagger’ and the auto_tagger gem is in the app’s bundle but not the system, running the system cap won’t find the auto_tagger gem. Using bin/cap runs the bundled cap and thus has access to all the gems in the bundle.”

  • 0 Shares
  • Share on Facebook
  • Share on Twitter
Pivotal Labs

Standup 1/4: XSS Galore

Pivotal Labs
Tuesday, January 5, 2010
  • XSS #1: There’s a huge cross-site scripting hole if you use the meta refresh tag…it has a “data” attribute into which you can insert arbitrary javascript.

  • XSS #2: Cross-site scripting resources, from an internal mailing list:

    • “I’ve gained a new appreciation for the importance of carefully thinking through security and escaping in RoR there’s more than just h()’ing all your user entered data.”

    • XSS vulnerabilities – http://ha.ckers.org/xss.html.
      Very useful catalog of different XSS vectors. Includes some utilities to base64-, URL- and hex- encode attacks so you can test out your apps.

    • General OWASP wiki – http://www.owasp.org/index.php/Main_Page. Lots of useful data information here. OWASP is a nonprofit group charted to improve the security of webapps in general.

    • Security Guide for RoR -
      http://www.lulu.com/product/download/owasp-ruby-on-rails-security-guide/4489819
      general guidelines/things to think about for securing RoR apps.

    • Loofah – http://github.com/flavorjones/loofah is supported by a fellow Pivot and provides fast and good sanitization built on Nokogiri, albeit slightly slower on short strings than brittle regular expressions. It’s in production at several companies.

      “Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib’s whitelist, so it most likely won’t make your codes less secure.”

  • Happy New Year

  • 0 Shares
  • Share on Facebook
  • Share on Twitter
Pivotal Labs

Standup blog

Pivotal Labs
Sunday, June 7, 2009

A couple more items from last week:

  • Help: acts_as_soft_deletable doesn’t seem to work with STI. The plugin has been out for a while and it’s surprising that nobody has had a problem with this before now.

  • Q: What’s a good way to bulk insert a bunch of joined-up models? A: insert into a view. MySQL has updatable views now. This is also a great trick to use in Oracle.

  • 0 Shares
  • Share on Facebook
  • Share on Twitter
Pivotal Labs

Standup blog

Pivotal Labs
Friday, June 5, 2009
  • There was a problem uploading files to s3 through Paperclip with # characters in the name (s3 doesn’t like # characters). There’s a fix on Paperclip trunk, but that hasn’t been packaged into a gem. Perhaps the Paperclip people could be convinced to cut a release?

  • One team is seeing files on s3 disappear occasionally. They’re using v2 of the s3 api, where the s3 gem uses v1. The team has now turned on s3 logging (which is off by default) – which they recommend everyone turn on as a general good practice.

  • 0 Shares
  • Share on Facebook
  • Share on Twitter
Pivotal Labs

net/http alternatives

Pivotal Labs
Monday, December 29, 2008

net/http is slow. (and so are libraries that depend on it, like open-uri)

Performance Disclaimer: this ought to matter in your app, measurably, before you do anything about it. If you profile and ruby-prof is showing a bunch of classes like BufferedRead and Timeout at the top of the list, your app qualifies. And in addition if you know that your app is dependent on data transfer over http (let’s say you’re interacting with a Solr server, and you’re storing sizable documents in Solr), you should be aware of the problem.

Otherwise net/http or open-uri might be just fine for you.

The problems with net/http, and benchmarks of ruby http client lbraries are nicely written about in An analysis of Ruby 1.8.x HTTP client performance.

Some good alternatives:

  • curb (libcurl wrapper)
  • rfuzz
  • httpclient / http-access2

Our findings matched the article referenced above – the alternatives have pros and cons but each was at least 10x faster than net/http for transfers of 50-300k response bodies.

The fastest solution we found was curb, reusing the Curl::Easy object:

require "curb"

curl = Curl::Easy.new

2.times do
    curl.url = "http://www.pivotaltracker.com"
    curl.perform
    puts curl.body_str
end
  • 0 Shares
  • Share on Facebook
  • Share on Twitter
Pivotal Labs

Standup: Sep 9th,10th,11th 2008

Pivotal Labs
Thursday, September 11, 2008

Interesting Things

  • ActiveRecord::Base.connection.select_all reads all records into an array, which is not good if you have a very large result set. Use a combination of ActiveRecord::Base.connection.execute with .each, or .each_hash if you want the same column<=>value mappings you get with select_all, only streamed.

  • There was some confusion about BlueCloth:

    • There’s a gem and a plugin available, and it appears that you need to use both
    • It seems like the only live BlueCloth development (i.e. where patches should be sumbitted) is here: http://github.com/github/bluecloth/tree/master
  • A recent MySql trigger experience:

    • In summary, think twice before using them when you have a viable application code alternative
    • They’re not cloned from the dev to test database
    • The hosting provider this project is using requires that we submit a change request each time we want to add/change/delete triggers. The problem with that is your trigger changes aren’t in sync with your code deployments.
    • It wasn’t hard to write the application code
  • During a discussion about humanize, a couple other nifty transforms were mentioned:

    • parameterize: You have a string, and you want to strip out characters that aren’t url-friendly. (follow the link for good example/discussion)
    • auto_link a Rails helper that takes text and links up all urls and email addresses.
  • 0 Shares
  • Share on Facebook
  • Share on Twitter

Topics

  • agile (778)
  • rails (113)
  • testing (87)
  • ruby (83)
  • ruby on rails (70)
  • jobs (62)
  • javascript (54)
  • techtalk (44)
  • rspec (38)
  • activerecord (29)
  • productivity (29)
  • gogaruco (29)
  • ironblogger (29)
  • git (28)
  • nyc (27)
  • rubymine (25)
  • mobile (22)
  • bloggerdome (21)
  • cucumber (20)
  • process (19)
  • pivotal tracker (19)
  • jasmine (19)
  • design (18)
  • ios (18)
  • webos (17)
  • objective-c (17)
  • android (16)
  • palm (16)
  • "soft" ware (16)
  • fun (15)
  • tracker ecosystem (15)
  • ci (15)
  • cedar (15)
  • rails3 (14)
  • performance (14)
  • bdd (14)
  • gem (13)
  • tdd (13)
  • selenium (12)
  • css (12)
  • goruco (12)
  • bundler (12)
  • meetup (11)
  • railsconf (11)
  • nyc-standup (11)
  • capybara (10)
  • mac (10)
  • mojo (10)
  • chef (10)
  • api (10)
Subscribe to agile standup Feed
  • About
  • Case Studies
  • Team
  • Community
  • Careers
  • Contact
  • Labs
  • Events

Contact Us

contact@pivotallabs.com
+1 415-77-PIVOT
TwitterLinkedInFacebook

Pivotal Tracker

Tracker is the award-winning agile project management tool that enables real-time collaboration around a shared, prioritized backlog.
Visit pivotaltracker.com >