Introducing the Maqetta HTML5 Editor

Introducing the Maqetta HTML5 Editor

6/19/13

When it comes to designing the User Interface of a Web or mobile app, nothing beats a WYSIWYG editor that allows you to visualize what you’re building as you go. In writing my Working with HTML5 in Eclipse Juno article, I was a little disappointed that Eclipse’s Web Page Editor doesn’t support HTML5 elements. That’s a significant drawback IMHO, so much so that it sent me on the hunt for a more suitable WYSIWYG editor. Now I may just have found the replacement that I was looking for: Maqetta. Created by IBM in 2011, it’s now an open source initiative of the Dojo Foundation that provides WYSIWYG web development in the cloud or locally. Moreover, it supports drag drop assembly of live UI mockups, including HTML5 components. In today’s article, I thought that I’d give Maqetta a once-over to get a feel for its design capabilities.

How to Use Maqetta

Maqetta is designed to run in the browser, but that shouldn’t be an issue to any Web designer/developer. However, not that it’s only approved for certain browsers, namely Google Chrome (current release), Firefox (current release) and Safari 5.1+ on the Mac. Internet Explorer is not supported at all.

If you’re going to be using Maqetta locally (more on that in a bit), you’re going to need Java Version 6 or greater installed on your machine. The makers of Maqetta also recommend that Windows users install the Java JDK (Java Development Kit) rather than the JRE (Java Runtime Environment). On Windows, the JDK makes the “java” command available to command line tools, whereas with the JRE, you’ll need to manually update the PATH environment variable to point to the bin folder under your Java installation.

There are three ways to run Maqetta:

One is to run it directly in the cloud. There is a button on the Maqetta.org site called “Launch Maqetta” button. The Maqetta team does their best to keep the application running that the server provides reasonable performance, but the application at Maqetta.org is available on an as-is basis with no guarantees about data persistence or security.

The second option is to install Maqetta locally, as we are going to do here today. This option will tend to result in better performance than its cloud counterpart, but it’s more difficult to share your mockups with your colleagues.

A hybrid solution is to install Maqetta on a company Intranet server. It gives you the best of both worlds, since you can protect all of your content as well as share it between individuals and teams. That also gives site administrators the option of customizing your company’s version of Maqetta to support your company’s widgets and themes.

Local Installation Step-by-Step

Installing Maqetta on your workstation is quite easy:

  1. Go to the Maqetta download page and download the .zip file.
  2. Extract the contents to your Programs directory.
  3. Download and install the Java 1.6+ SE(Standard Edition) JDK from Oracle if you don’t already have it. Installation instructions for the various operating systems can be found here.

Now you’re ready to launch the app.

  1. Double-click on the appropriate launch script (maqetta.server.win.bat for Windows, maqetta.server.mac.command for Mac).
  2. You should then see something like the following in your command prompt:

    H:DesktopHTMLGoodiesMaqettamaqettamaqetta.server.win.bat
    
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    NOTE: CLOSING THIS WINDOW WILL
          STOP THE MAQETTA SERVER PROCESS
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    
    Using directory : H:DesktopHTMLGoodiesMaqettamaqettausers
    Start your browser at http://localhost:50000/maqetta
    Unable to access jarfile org.eclipse.equinox.launcher_1.3.0.v20120522-1813.jar
    H:DesktopHTMLGoodiesMaqettamaqettamaqetta.server.win.bat
    
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    NOTE: CLOSING THIS WINDOW WILL
          STOP THE MAQETTA SERVER PROCESS
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    
    Using directory : H:DesktopHTMLGoodiesMaqettamaqettausers
    Start your browser at http://localhost:50000/maqetta
    14:39:39,545 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Could NOT
     find resource [logback.groovy]
    14:39:39,545 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Could NOT
     find resource [logback-test.xml]
    14:39:39,545 |-INFO in ch.qos.logback.classic.LoggerContext[default] - Found res
    ource [logback.xml] at [bundleresource://2.fwk30518483:1/logback.xml]
    14:39:39,702 |-INFO in ch.qos.logback.core.joran.spi.ConfigurationWatchList@1124
    746 - URL [bundleresource://2.fwk30518483:1/logback.xml] is not of type file
    14:39:39,867 |-INFO in ch.qos.logback.classic.joran.action.ConfigurationAction -
     debug attribute not set
    14:39:39,873 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About t
    o instantiate appender of type [ch.qos.logback.core.ConsoleAppender]
    14:39:39,876 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming
    appender as [STDOUT]
    14:39:40,076 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - This append
    er no longer admits a layout as a sub-component, set an encoder instead.
    14:39:40,076 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - To ensure c
    ompatibility, wrapping your layout in LayoutWrappingEncoder.
    14:39:40,076 |-WARN in ch.qos.logback.core.ConsoleAppender[STDOUT] - See also ht
    tp://logback.qos.ch/codes.html#layoutInsteadOfEncoder for details
    14:39:40,077 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Settin
    g level of logger [org.eclipse.orion.server.login] to INFO
    14:39:40,077 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Settin
    g level of logger [org.eclipse.orion.server.account] to INFO
    14:39:40,077 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Settin
    g level of logger [org.eclipse.orion.server.config] to INFO
    14:39:40,077 |-INFO in ch.qos.logback.classic.joran.action.RootLoggerAction - Se
    tting level of ROOT logger to WARN
    14:39:40,077 |-INFO in ch.qos.logback.core.joran.action.AppenderRefAction - Atta
    ching appender named [STDOUT] to Logger[ROOT]
    14:39:40,079 |-INFO in ch.qos.logback.classic.joran.JoranConfigurator@105691e -
    Registering current configuration as safe fallback point
    
    2013-06-13 14:39:40.129 [Start Level Event Dispatcher] INFO  org.eclipse.orion.s
    erver.config - Server configuration file loaded from: H:DesktopHTMLGoodiesMaq
    ettamaqettamaqetta.conf
    Registering Zazl JavaScript servlet
    Registering Maqetta HTML Filter for Zazl
    2013-06-13 14:39:46.348 [Start Level Event Dispatcher] WARN  org.apache.solr.cor
    e.SolrCore - [Eclipse Web Search] Solr index directory 'H:DesktopHTMLGoodiesM
    aqettamaqettausers.metadata.pluginsorg.eclipse.orion.server.core.searchdat
    aindex' doesn't exist. Creating new index...
    osgi 13-Jun-2013 3:53:31 PM maqetta.server.orion.EmailOverrideFilter init
    INFO: Initializing...
    13-Jun-2013 3:53:31 PM maqetta.server.orion.EmailOverrideFilter overrideEmailCon
    tents
    INFO: Overriding Orion email templates
    
  3. Navigate to “http://localhost:50000/maqetta” using one of the approved browsers and voila, the login screen will appear:

  1. Even locally, you still have to register before you can use the system. The cloud version is exactly the same, except that it sends a confirmation email to your inbox. That functionality is not supported by the local installation (not surprising!).

  2. Once you’ve registered, you can log into the app, at which point you’ll arrive to the welcome screen:

Adding Widgets to Your Web Page

Widgets are found in the Palette on the right-hand side of the page. Not to be confused with form controls, widgets include just about any component that you could place on a Web page, including header tags, labels, images, and even specialized controls such as sliders, validating textboxes, calendars, and charts.

I found that the best way to find what I was looking for was to start typing the name of the element that I wanted in the filter box until it came up in the palette. For instance, typing “h” quickly brought up the header tags:

Once you’ve brought up an element in the palette, it may be dragged into the design editor and placed in the desired location in the document flow. Here’s a test form that I threw together:

Coding Functionality

Every time you create a new Application in Maqetta, an app.js file is created for you. You’ll see it in the Files Palette in the lower-left quadrant of the IDE. Double-clicking the file will open it in the editor pane with some boiler plate code done for you:

/*
 * This file is provided for custom JavaScript logic that your HTML files might need.
 * Maqetta includes this JavaScript file by default within HTML pages authored in Maqetta.
 */
require(["dojo/ready" ], function(ready){
     ready(function(){
         // logic that requires that Dojo is fully initialized should go here
     });
});

Needless to say, being a Dojo Foundation initiative, dojo is the only JS library natively supported by Maqetta. You can add others, but we’ll cover how to do that another day. For now, let’s add a handler for the button’s onclick event.

The first step is to give the button an ID so that we can refer to it in the script. To do that, select the button in the designer and click the Widget tab on the far right to bring up its properties. Then, assign it an ID of “btn”:

Next, open the app.js code in the editor by double-clicking it.

In the ready() function, add the following call to dojo.connect():

dojo.connect(dojo.byId("btn"), "click", function(evt){
  alert("button clicked");
});

Previewing the Page

Directly over the Widget tab that we used to assign the button ID, there’s a boxed arrow button. Save your files and click it to preview the page in the browser. Here’s what our test page looks like:

Conclusion

Maqetta looks very promising at this point, but more maturation time might be in order. It’s very good, but perhaps not quite good enough to lure users of Eclipse or DreamWeaver CC, despite its HTML5 compliance. But don’t let me sway you, try it out. If you’re a die-hard Dojo fan, it might be the perfect tool for you.


If you enjoyed this article, please contribute to Rob’s rock star aspirations by purchasing one of Rob’s cover or original songs from iTunes.com for only 0.99 cents each.

Rob Gravelle resides in Ottawa, Canada, and is the founder of GravelleWebDesign.com. Rob has built systems for Intelligence-related organizations such as Canada Border Services, CSIS as well as for numerous commercial businesses. EmailRob to receive a free estimate on your software project.

In his spare time, Rob has become an accomplished guitar player, and has released several CDs. His former band, Ivory Knight, was rated as one Canada’s top hard rock and metal groups by Brave Words magazine (issue #92).

Rob uses and recommends MochaHost, which provides Web Hosting at $3.10 per month, 2 LifeTime Free Domains, and 6 Months Free!

Article source: http://www.htmlgoodies.com/html5/other/introducing-the-maqetta-html5-editor.html

Some WordPress Ecommerce Plugins Pose Security Risk


An Israel-based security firm researched the top 50 plugins used by users of the WordPress publishing platform, and their study uncovered many demonstrating vulnerabilities to common web attacks.

The firm, Checkmarx, claimed nearly 8 million downloaded plugins were at risk of being susceptible to malicious activity. Of the top 10 ecommerce plugins downloaded by WordPress users, seven proved vulnerable. Checkmarx said these ecommerce plugins had been downloaded 1.7 million times.

“At the root of the problem is the lack of security standards that PaaS-providers (aka app marketplaces) enforce on the apps that they distribute,” Checkmarx said. “The app marketplaces are in that unique position to set a security policy on the apps that they distribute. The marketplace needs to ensure that only those apps which passed its specific security bar are authorized for the public.”

One of the common attacks used by criminal hackers is SQL injection. This attack involves attempting to pass malicious code through a web application, like an online store, and try to retrieve details about the site’s users. Credit card information and login details are especially valuable.

Checkmarx had some advice for online merchants using the popular blogging software to power their stores. Ecommerce pros using WordPress plugins for their sites should only download from WordPress.org, and check to ensure they are running the most current version of those plugins. Check with the publisher of the plugin to determine if they have been updating their software and patching potential vulnerabilities.

Article source: http://www.ecommercebytes.com/cab/abn/y13/m06/i20/s01

Google’s JavaScript challenger gains better tools, performance

Agentless Backup is Not a Myth

Hot on the heels of Microsoft’s latest TypeScript release, Google has shipped the first beta SDK for Dart, its own JavaScript killer alternative web language, including bug fixes, performance enhancements, and an improved editor.

Like TypeScript, Dart is a language aimed at making it easier to develop large, complex web applications that are efficient, secure, and maintainable. It compiles into JavaScript, so it can run in any modern web browser, but its syntax is designed to ameliorate some of JavaScript’s more glaring flaws.


With the beta release, the Dart compiler produces JavaScript code that is up to 3.7 times smaller than that produced by earlier versions, according to a blog post announcing the update. The compiler also runs between 8 and 20 per cent faster when tested against benchmark code.

Performance of the Dart VM – a standalone virtual machine that can execute Dart code natively – without compiling it into JavaScript – has also been improved. The new version includes full SIMD acceleration, and can execute benchmark code as much as 40 per cent faster than previous releases.

Some of the biggest improvements in the beta, however, are to the Dart Editor. The new version features a rewritten code analysis engine that can parse code and locate potential problems 20 per cent faster than before.

The beta editor includes a number of new code refactoring options and new “quick fixes” for automatically resolving code issues. It also features new code completion options, such as the ability to detect “camel case” – so you can type “gN” and the editor will guess that you want a method called “getNext,” for example.

In addition, a new “pub deploy” command pulls together all of an application’s code and assets and packages them into a directory for easy deployment to a web server.

The Dart team has made a number of other tweaks and enhancements to the language’s libraries and tools, too – for a complete list, check out the formal release notes here.

This first beta brings the Dart language that much closer to a formal release, but as for when we can expect Dart 1.0, there’s still no word. Google has hinted a few times that it plans to finalize the first release sometime around this summer, but as with so many projects from the Chocolate Factory, it hasn’t firmly committed to any timeline.

Dart is open source software released under the BSD License. The beta Dart SDK, tools, documentation, and code samples can all be found at the project’s homepage. ®

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Article source: http://www.theregister.co.uk/2013/06/19/dart_beta/

gTar opens up iOS and Javascript SDK, adds Ableton Live compatibility

gTar opens up iOS and Javascript SDK, adds Ableton compatibility

It’s been a while since we’ve heard anything out of the gTar camp — nearly half a year in fact, when the company announced pre-orders the week of CES. This morning the Kickstarted instrument manufacturer broke the silence by announcing that it’ll be opening up its SDK for both iOS and Javascript, letting developers create apps for browsers and Apple’s mobile operating system. The learning-friendly instrument already has a bit of a head start, as it’s presently compatible with more than 150 apps, according to the company. Compatibility also extends to Ableton Live, via an “unofficial custom script” that makes it possible to use the gTar’s fretboard as a control panel for the popular DJ software.

Article source: http://www.engadget.com/2013/06/19/gtar/

New features to WordPress 3.6 Beta 3

Last month WordPress released the Beta 3 version of WordPress 3.6.

Beta 3 contains many features including better post formats, more audio video support, auto save function, better navigation menus the updates default theme – “Twenty Thirteen”.

The new post formats have a drag-and-drop image upload, which allows website designers to upload images and files easily. This update also has its own custom Meta fields such as different image post formats, link formats, video formats custom fields for quotes.

Audio Video support has been made much simpler. WordPress has included MediaElement.js library allowing developers to avoid the use of external plugins.

Users will now be able to automatically save posts locally. They will not have to worry if their browser crashes or their server goes offline, their post will get saved in drafts.

The new default theme – Twenty Thirteen is very different from its previous versions. It’s a bright and colourful theme and is aligned to the new Beta 3 updates posts formats. It’s certainly a format which would be beneficial in creating new, affordable web designs.

For more information, visit Pom Design at:

http://www.pomdesign.com/

Contact Name:admin Company: Web Optimiser Contact Email:click to reveal e-mail Contact Phone:020 7953 8412

Article source: http://www.journalism.co.uk/press-releases/new-features-to-wordpress-3-6-beta-3/s66/a553325/

After 80M Installs, MoboTap Updates Its Dolphin Browser To Highlight HTML5 …

Long-time Android fans (fandroids?) will probably be familiar with Dolphin, the third-party browser that first made a name for itself during the ways when the stock Android browser left much to be desired. It’s been making some considerable strides over the past year whether you noticed or not, and today the team at MoboTap have pushed out yet another substantial update into the Google Play store.

The new build plays home to a handful of significant UI tweaks — users now have one swipe access to gesture and voice commands, and can drill down their search results to focus solely on results from sites like Amazon, eBay, and YouTube. The biggest addition to the mix though? A HTML5 web app repository that gets featured prominently when you first fire up the browser. It may not seem like a huge leap for the company considering just how strongly it’s tried to play up its speedy HTML5 rendering over the past year, but Mobotap hopes that providing quick access to rich web apps will change how people interact with their phone’s browser.

“We want Dolphin to be people’s second homescreen,” MoboTap corporate strategy head Edith Yeung told me. “You don’t actually need to run all these native apps, you just run things in the browser.”

MoboTap says they’ve got “over 200” web apps indexed in their storefront, all of which can be added to the browser’s speed dial screen and slotted into different folders for quick access. Once you’ve got the speed dial loaded up with links it bears a passing resemblance to your typical Android homescreen, but their vision of a rich smartphone experience being contained within a browser hasn’t been achieved just yet. Yeung concedes that it’s very much a work in progress though, and that the company is working to make this particular sea change as smooth as possible — they’ve made their share of drastic changes in the past, much to the chagrin of unsuspecting users.

So what’s next in MoboTap’s push to proliferate HTML5? So far we’ve seen a handful of gutsy companies make a case for the web as a platform — Google is still doggedly pushing the concept with ChromeOS and some frankly impressive hardware, while Mozilla’s Firefox OS is being loaded onto entry-level smartphones in anticipation of an impending launch this summer. That sort of hardware-inclusive approach is one hasn’t been on the table thanks to MoboTap’s size, but as far as they’re concerned branching into hardware is problematic unless you’re tremendously well-connected.

“We have a very good relationship with the people at Firefox, but we have a very different theory,” Yeung added. “Firefox likes to have complete control, which is great, but from our experience working with the OEM, it’ll be different for any OEM to commit to any significant volume of phones.” Instead, the company has been spending its time and resources trying to ink potentially fruitful pre-install deals with carriers (and especially big players in southeast Asia) — MoboTap linked up with KDDI to pre-load the browser on a slew of Japanese Android phones, and it quietly locked up a similar deal with China Telecom back in January. So far, the strategy seems to be working — MoboTap confirmed that Dolphin has already been installed on over 80 million devices across the globe, though the company wouldn’t break down how many downloads came from users who found the app on their own and installs stemming from pre-install partnerships.


  • DOLPHIN BROWSER
  • MOBOTAP

Dolphin is the simplest way to browse the mobile web. It is smart, playful and it adapts to the way you want to browse. Open your favorite web pages with just a touch of your finger tip, or you can install any Add-ons and make Dolphin look, feel and function just the way you like it. Learn more about our most popular features here. With over 8 million downloads and growing daily, Gigaom called Dolphin is a “must try”…

→ Learn more

MoboTap is a mobile technology developer that is committed to advancing the mobile revolution by improving the way people experience the web through their mobile devices. Founded and led by an international team of proven engineers and entrepreneurs, MoboTap has begun this revolution with the launch of Dolphin Browser, a free web-browser specifically created and optimized for Andriod users.

→ Learn more

Article source: http://techcrunch.com/2013/06/19/after-80m-installs-mobotap-updates-its-dolphin-browser-to-highlight-html5-apps/

Use Flipbook Creator to Design HTMl5 Flipping Book

GuangZhou, China — (SBWIRE) — 06/19/2013 — Flipbook Creator is a digital document converting and publishing tool that allows users to create mobile versions of page-flipping e-books. Users can convert PDF files into e-books with Flash-based flipping animations. Books, magazines, catalogs, brochures, and more can be designed and published online, sent via email, or distributed on mobile devices or social media.

The software interface includes many tools for adding templates, themes, and scenes, plus adding audio narration and selling the e-book online. Tools for adapting a flipbook for reading on a mobile device are just as easy. Doing so in fact increases the likelihood of selling the e-book, since many people prefer to read using their mobile device. They can sit in any comfortable position and open the e-book any time. All it takes is just a few simple steps.

- Start up the software Flipbook Creator.

- Import the PDF file to be converted into the e-book. Selecting the file from a list is simple, and the rest of the process occurs automatically. Wait until the import process is completed.

- In the “Design Settings” panel, choose the desired template and theme, depending on how the e-book is intended to look.

- On the “Output Type” setting, choose .html and check the box next to “Also Make Mobile Version”.

Mobile devices are unique in that they have a smaller screen, requiring websites and e-books to be customized to fit on the screen and be readable. Being that they have processing power equal to desktops and laptops, not to mention being portable and more versatile, people are apt to use them for many things. They are also lighter and easier to carry than traditional books. This makes a mobile e-book a more powerful tool for building a readership. Anyone selling their flipbooks will find that the software now helps them to increase sales as part of their business.

The mobile output option is integrated seamlessly into the Flipbook Creator software interface. By following the steps above, a mobile flipbook can be created in just a few minutes. For users needing additional instruction, a step-by-step tutorial page is available on the website. Extra help is always available by logging onto http://www.flippagemaker.com/flippingbook-maker/ for more information or downloading the software for Windows or Mac computers.

About FlipPageMaker.com
FlipPageMaker.com is a China based company that provides software tools for publishing e-books, magazines, brochures, reports, catalogs, and more. Its software is suitable for a range of uses and industries. The company’s products are available worldwide and customization is available to anyone who requires such services.

Press Release source : AB Newswire

Article source: http://www.sbwire.com/press-releases/use-flipbook-creator-to-design-html5-flipping-book-268444.htm

Why HTML5 is Not Enough

Modern mobile browsers are amazing. Deliver the right combination of HTM5/CSS3/JavaScript markup to them, and you can produce amazing mobile applications, but don’t kid yourself into thinking it is just that easy. Using low-level HTML5-based techniques, your efforts to arrive at that magical, optimized, cross-platform markup will be fraught with peril and pain.

This white paper describes many of the pitfalls associated with HTML5 development, including the fact that:

  1. Not all browsers are created equal: not even WebKit-based browsers – this has been, and always will be, a huge problem for web applications. The same markup will not produce the same results on all platforms
  2. HTML5 is not a development language – Often a whole heap of JavaScript is needed to make that HTML5 markup do what it is supposed to do; however, cross-browser idiosyncrasies abound, complicating the development process further
  3. HTML5 does not do push – Push is central to delivering collaborative features in a web application; however, HTML5 offers nothing in this arena, and developing a JavaScript push solution of your own is a hugely onerous task
  4. HTML5 lacks comprehensive native support – Over time, more native features will be addressed by the spec, but you can’t afford to move at spec speed, so if you need hybrid capabilities you will need to augment your HTML5 strategy in some way

This white paper looks at how the new ICEmobile project addresses these pitfalls, enabling enterprise Java developers to effectively build mobile solutions using common Java EE web technologies and tools.

Article source: http://www.infoq.com/vendorcontent/show.action?vcr=2310&utm_source=infoq&utm_medium=VCR&utm_campaign=vcr_homePage_click

"Learning how to write a 3D soft engine from scratch in C#, TypeScript or … – Microsoft

Today’s wild Wednesday project is from, David Rousset, who walks us through creating a software based 3D engine, in C#, TypeScript and JavaScript. In short pick the language that’s best for you and follow along with him as he talks 3D, matrix math and code…

Tutorial series: learning how to write a 3D soft engine from scratch in C#, TypeScript or JavaScript

I’d to like to share with you how I’ve learned to build what’s known as a “3D soft engine” through a series of tutorials. “Software engine” means that we will use only the CPU to build a 3D engine in an old school way (remember Doom on your 80386 ?). I’ll share with you the C#, TypeScript and JavaScript versions of the code. In this list, you should then find your favorite language or at least something near your favorite one. The idea is to help you transposing the following samples concepts on your favorite platform. You’ll find the Visual Studio 2012 C#/TS/JS solutions to download at the end also.

So why building a 3D soft engine? Well, it’s simply because it really helps understanding how modern 3D works with our GPUs. Indeed, I’m currently learning the basics of 3D thanks to internal workshops delivered within Microsoft by the awesome David Catuhe. He’s been mastering 3D for many years now and matrices operations is hard-coded in his brain. When I was young, I was dreaming to be able to write such engines but I had the feeling it was too complex for me. Finally, you’ll see that this is not – that – complex. You simply need someone that will help you understanding the underlying principles in a simple way.

Through this series, you will learn how to project some 3D coordinates (X, Y, Z) associated to a point (a vertex) on a 2D screen, how to draw lines between each point, how to fill some triangles, to handle lights, materials and so on. This first tutorial will simply show you how to display 8 points associated to a cube and how to move them in a virtual 3D world.

By properly following this tutorial, you will have the following result at the end:

image

image

Tutorial part 2: learning how to write a 3D soft engine from scratch in C#, TS or JS – drawing lines triangles

Now that we have built the core of our 3D engine thanks to the previous tutorial Tutorial series- learning how to write a 3D soft engine from scratch in C#, TypeScript or JavaScript, we can work on enhancing the rendering. The next step is then to connect the dots to draw some lines in order to render what you probably know as a “wireframe” rendering.

In this tutorial, you will learn how to draw lines, what a face is and how cool is the Bresenham algorithm to draw some triangles.

Thanks to that, at the end, you will know how to code something as cool as that:

image

Again, you can download the solutions containing the source code: [GD: Click through to the original article for the download links]

- C# : SoftEngineCSharpPart2.zip
- TypeScript : SoftEngineTSPart2.zip
- JavaScript : SoftEngineJSPart2.zip or simply right-click – view source on the embedded iframe

In next tutorial, you will learn how to export some Meshes from Blender, a free 3D modeler tool, into a JSON format. We will then load this JSON file to display it with our wireframe engine. Indeed, we already have everything setup to display much more complex meshes like these one:

image

Here’s a snap of the C# version (which is also a Windows Store App);

image

And its Project;

image

image

While not Halo, in the end, if you follow along, you’ll still be one step ahead…

Article source: http://channel9.msdn.com/coding4fun/blog/Learning-how-to-write-a-3D-soft-engine-from-scratch-in-C-TypeScript-or-JavaScript

Native JavaScript Equivalents of jQuery Methods: CSS and Animation

Do You Really Need jQuery? Sometimes — especially if you want to support IE6/7/8 using jQuery 1.x. However, modern browser APIs now provide much of the functionality we take for granted in jQuery. In this article, we’re going to look at methods related to CSS.

Class Manipulation

One of the most common jQuery tasks is applying a class to a specific element:

$("#myelement").addClass("myclass");

We can achieve the same thing in native JavaScript:

document.getElementById("myelement").className = "myclass";

This isn’t quite the whole story:

  1. jQuery can apply the class to any number of nodes.
  2. jQuery appends the new class to existing class definitions, but the native example will overwrite them.

In native JavaScript, the className property is simply a string. We therefore need a function to replicate how jQuery works, e.g.

function addClass(node, class) {
	if (!node.length) node = [node];
	for (var n = 0, m = node.length; n  m; n++) {
		if ((" " + node[n].className + " ").indexOf(" "+class+" ") = 0) {
			node.className += " " + class;
		}
	}
}
// apply myclass to all nodes
addClass(document.getElementById("myelement"), "myclass");

While this code is smaller and faster than jQuery, we’re replicating what’s already available in the library — there’s little point.

Fortunately, modern browsers now offer a new classList property which implements a DOMTokenList — an array-like collection of all classes applied to a node. The following properties are available:

  • length — the number of class names applied
  • item(index) — the class name at a specific index
  • contains(class) — returns true if a node has that class applied
  • add(class) — applies a new class to the node
  • remove(class) — removes a class from the node
  • toggle(class) — removes or adds a class if it’s applied or not applied respectively

We can use this in preference to the clunkier className property:

document.getElementById("myelement").classList.add("myclass");

classList is supported by most browsers except IE9. Fortunately, a couple of shims are available which could be conditionally loaded in that browser.

Style Manipulation

jQuery provides a number of methods to apply specific styles, e.g.

$("#myelement").css({
	color: "#c00",
	backgroundColor: "#eee",
	width: "200px",
	height: "100px",
	borderColor: "#f00"
});

The native equivalent:

var m = document.getElementById("myelement"), c = m.style;
c.color = "#c00";
c.backgroundColor = "#eee";
c.width = "200px";
c.height = "100px";
c.borderColor = "#f00";

Over 10,000 iterations using cached selectors, the jQuery code executed in 6,670ms. Native JavaScript took 330ms — it was 20x faster.

Of course, you shouldn’t use either unless a value needs to be calculated in some way. It’s more efficient to define a class of styles in CSS then apply its name to the element.

Animation

jQuery offers various animated effects out of the box including sliding and fading. Native JavaScript can be faster but none of that matters: CSS3 animation trounces both.

I was initially skeptical about CSS3 animation. It can never offer fine-grained control (such as stopping an animation after N frames) and trespasses on JavaScript’s behavioral responsibilities. However, the benefits more than outweigh the drawbacks:

  1. CSS3 animation is handled by the browser; it will always be faster than JavaScript execution.
  2. CSS3 animation is easier to use and requires significantly less code.
  3. CSS3 offers effects such as 3D transformations which would be impractical — if not impossible — in JavaScript alone.

IE9 and below won’t show the effects but they can degrade gracefully and IE10 should be the dominant version within a few months.

The CSS3 genie will never go back in the lamp. If you’re still using jQuery or JavaScript for DOM animation in modern browsers, you’re probably wasting your time.

That said, JavaScript can be used to react to CSS3 animations when they start, stop or proceed to the next iteration using animationstart, animationend and animationiteration accordingly. For more information, refer to How to Capture CSS3 Animation Events in JavaScript.

In my next article, we’ll finish the series by looking at events, Ajax and utility functions.

Series Navigation

Native JavaScript Equivalents of jQuery Methods: the DOM and Forms


Get Started with
Ruby on Rails

Github, Twitter and Hulu. All huge. All successful. All Rails.

Learn the web development framework of the moment with our newest book and course.

Learn Rails

Article source: http://www.sitepoint.com/jquery-vs-raw-javascript-2-css3-animation/

Asahi Technologies Announces Custom WordPress Development Services for …


Published: June 19, 2013 3:48 AM

New York based web design and development firm, Asahi Technologies today announced the launch of custom WordPress development services to develop bespoke plugins and functionality to meet specific organizational requirements.

New York (PRWEB) June 19, 2013

WordPress is great out of the box but it can be really awe-inspiring after a few customizations with plugins. Plug-ins are a great way to enhance the functionality of the blog by adding extra features. These can be placed anywhere inside the template by function hooks. WordPress specifically offers such advanced features in its CMS that unique plug-ins are rare. With custom-made plugins, businesses can handle any functionality or feature. For instance businesses can add a forum, a reservation system, web forums, job boards, and even a classic webpage Content Management System or anything they need to.

Amid thousands of WordPress plugins, it often gets difficult to find out those plugins that fulfill unique requirements while ensuring that they are bug free. Realizing this, companies are increasingly turning to third party developers to develop customized plugins that give them all the functionalities they were seeking in their website. Custom WordPress plugins simplify the content management tasks of website owners and allow them to get rid of the fret caused by bugs. And to help businesses with customized plugins tailored to their needs, the NY based Tech firm has launched affordable custom WordPress plugin development services in New York.

A WordPress Plugin is simply a program or a group of one or more functions which is written in popular programming language PHP. This helps to add significant set of features or services to the WordPress based website or blog site. With the help of WordPress plugin one can easily modify, customize, and enhance WordPress based website. Customised WordPress plugin
enables site owners to add additional functionality in website without changing the core WordPress programming. WordPress plugin is one of the fabulous features that WP offers to customize WordPress based websites or blogs. This also makes each WordPress blog differ from one another.

At Asahi Technologies the developers with expertise in WordPress plugin development, create intuitive and highly scalable plugins for WordPress blogs and websites. Using powerful PHP scripting language, they develop WordPress plugins, with clear codes and integrated features. By customizing and integrating the plugins they help in enhancing the features and functionalities of their client’s WordPress website or blog. In addition to WordPress plugin development, the NY based firm also offers services in plugin upgrade and enhancement, thereby improving the overall performance of blog or website.

To help businesses know more about WordPress plugin development services, Asahi Technologies provide a free online consultation to clients letting them understand their development options.

About Asahi Technologies

Asahi Technologies is a New York based web design and development firm that provides software consulting and Web solutions to small and medium level businesses all across North America. Asahi Technologies specializes in responsive design, cloud computing, online marketing, mobile application development and open source technologies. Under the leadership of Mr. Vinod Subbaiah, who himself started his career as a software programmer, Asahi Technologies’ team comprises of experienced software professionals having extensive knowledge of technology with B2C and B2B operations. The firm’s headquarters is located in New York City, NY.

For the original version on PRWeb visit: http://www.prweb.com/releases/prweb2013/6/prweb10848315.htm

Article source: http://www.newsday.com/business/asahi-technologies-announces-custom-wordpress-development-services-for-businesses-in-new-york-1.5518120

Beware Of HTML5 Development Risks

As HTML5 continues to experience a groundswell of acceptance within the developer community, organizations must think seriously about how key changes in this latest standard will require them to shift their application security paradigms for web and mobile apps. Designed to help developers more closely mimic native application through browser-based apps, HTML5 includes a number of useful features that pose as double-edged swords from a security perspective.

“It provides a slew of new programming methods to web sites that could present new security challenges and privacy risks to end users and site operators alike,” says Aaron Rhodes, senior security consultant for Neohapsis, a mobile and cloud security services firm.

None of these is as potentially useful—and damaging—as the standard’s enhanced capabilities for storing and manipulating data on the client, most experts agree.

“At the end of the day, one of the biggest changes is the change of functionality that HTML5 brings, which is its all pushed to the client. That’s one of the beuaties and also one of the dangers of HTML5,” says Steve Orrin, director of security architecture at Intel. “It’s a significant paradigm shift. Especially in cases where the native applications are phone- or tablet-based, where it doesn’t have the conventions of a browser and it has access to native resources.”

Local storage is a big change from HTML of the past, where browsers could only store cookies to store small bits of information like session tokens for managing identity.

[How have attackers managed to 'break' AV with a glut of malware? See 10 Ways Attackers Automate Malware Production.]

“HTML5 changes this with sessionStorage, localStorage, and client-side databases to allow developers to store vast amounts of data in the browser that is all accessible from Javascript,” says Dan Kuykendall, CTO of web application firm NTO OBECTives, who explains that while this provides the opportunity for feature-rich applications and greater offline capabilities, it also opens up a new field of opportunity to attackers. “An attacker could retrieve this data, or manipulate the data which would then get used again later by the application and may be uploaded back to the server to attack others as well.”

As a result, developers have to design with the dangers in mind and weigh that against the type and sensitivity of data stored in the client. At the moment, many development shops are not training their staff to do that, says David Eads, founder of Mobile Strategy Partners, a mobile development firm that specializes in financial and insurance applications. In fact, he recently ran into a bank that used example HTML5 code for training developers that put data in permanent storage on the client system as opposed to temporary storage.

“There are security issues with even leaving it on temporary storage, but putting it in permanent storage is a bad, bad, bad idea,” he says. “And because it is their example, some young developer at the bank is liable to do it that way because he is just typing what he saw.”

Storage on the client isn’t the only added security consideration brought to bear by HTML5 APIs. They also add additional access to on device features with huge privacy considerations.

“Another area of concern is rights-based access to system services such as camera, microphone and GPS,” says Dan Shappir, CTO of Ericom Software, a remote access software developer that has embraced HTML5. “It is highly likely that many users will grant access to such services without considering the security and privacy implications.”

Additionally, HTML5 also opens up the field for potential vulnerabilities in third-party code.

“Until HTML5, JavaScript has been limited to requesting resources from the domain from which it was loaded,” Kuykendall says. “With the addition of cross-origin resource sharing (CORS) this has been changed to allow JavaScript to request resources from different domains.”

It’s a useful feature when used in conjunction with strict policies, says Kuykendall, but it could pose problems without. He recommends that developers never use wildcards in Access-Control-Allow-Origin, lest they open themselves up to attacks like click-jacking.

Organizations should generally beware of third-party code when using HTML5 due to the permissions generally allowed on the client, says Brad Carleton, founder and CTO of TechPines, an app development firm.

“Take extra precaution when running code from third parties because they will also have access to whatever permissions have been granted to your application,” he says. “This is compounded when you are dealing with multiple third parties, because as they are compromised, so can be your users.”

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/applications/beware-of-html5-development-risks/240156891

Foreign keys, JavaScript support on deck for MySQL Cluster update

Agentless Backup is Not a Myth

Following more than 12 months of development and preview releases, Oracle has announced general availability of MySQL Cluster 7.3, bringing a number of important new features and enhancements to the open source clustering add-on for the MySQL database.

The really big news, according to a press release issued on Tuesday, is the long-awaited inclusion of support for foreign key constraints, which had been one of the most requested feature enhancements for the product.


MySQL Cluster differs from its more powerful cousin, Oracle Real Application Clusters (RAC), in that it uses a “shared nothing” architecture, where none of the nodes share memory or disk storage. In this sense, its design is closer to how IBM DB2 handles clustering than to RAC.

With MySQL Cluster 7.3, the system can now automatically enforce foreign key referential integrity between tables, regardless of whether they are located in different nodes, different shards (partitions), or even in different data centers.

Foreign key support is also available whether the application accesses the database via SQL or via one of the various non-SQL APIs that are available, such as Java, Memcached, or HTTP/REST.

The new version’s SQL layer is now based on the latest MySQL 5.6 release, which allows database admins to combine the InnoDB and MySQL Cluster storage engines side-by-side on the same MySQL 5.6 server.

MySQL Cluster 7.3 also adds another major non-SQL access method, namely JavaScript support via Node.js. This allows applications written in JavaScript to directly access MySQL Cluster data stores without translating queries to and from SQL.

Even those users who aren’t interested in the new features might want to upgrade, however, as version 7.3 reportedly delivers between 1.5 and 7.5 times more data throughput to cluster nodes. It does this in a way that is completely transparent to applications, meaning admins should see their applications’ performance improve as soon as they upgrade to version 7.3.

Setting up new clusters is also easier than ever, thanks to a new auto-installer that allows admins to graphically configure and provision a cluster “within minutes” using a browser-based interface.

The full set of changes from the previous release can be reviewed in the official release notes, available here.

MySQL Cluster is open source software released under the GPLv2 license, and Oracle also offers commercial support along with a number of proprietary add-ons in the form of its MySQL Cluster Carrier Grade Edition (CGE) product.

There are other ways to cluster a MySQL database, however, including ScaleDB and Galera, the latter being a set of patches that bake clustering support into the MySQL server itself. In particular, those who have already migrated from MySQL to the competing MariaDB fork will want to consider one of the above options, as MariaDB does not support MySQL Cluster’s NDB storage engine out of the box.

The GPL-licensed version of MySQL Cluster 7.3 is available for download from Oracle’s MySQL website as of Tuesday. ®

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Article source: http://www.theregister.co.uk/2013/06/19/mysql_cluster_73/

Popular WordPress Plugins Vulnerable to Attack: Checkmarx Research

Research from security vendor Checkmarx revealed that 12 of the top 50 plug-ins for the WordPress platform are susceptible to attacks such as SQL injection and cross-site scripting.

A new study has found that roughly 20 percent of the 50 most popular plug-ins for the WordPress platform are vulnerable to common Web attacks.
According to research from security vendor Checkmarx, that figure represents nearly 8 million downloads of plug-ins vulnerable to issues such as SQL injection, cross-site scripting, cross-site request forgery and path traversal. Additionally, the research revealed that seven out of the top 10 most popular e-commerce plug-ins for WordPress are vulnerable to attacks as well—translating to more than 1.7 million downloads.
The findings, Checkmarx argues, indicate a deeper problem than risky problems. At the root of the issue is a lack of security testing and standards by platform-as-a-service (PaaS) providers when it comes to the apps they distribute, as well as a failure by Web administrators to go the extra mile to ensure the plug-ins are safe.
“First of all, Web admins think that if they are downloading these plug-ins from a reputable source, then there is an assumption that they are receiving a secure plug-in,” said Maty Siman, CTO of Checkmarx, in an interview. “In our opinion, that is the biggest factor.”

Web administrators also are challenged by scheduling and prioritizing issues, he said, explaining that not everyone knows what to do with the source code once it’s scanned and vulnerabilities are found.


Click here

“Mitigating these issues is extremely overwhelming to the basic Web admin. It’s not a straightforward process,” he said.
The first scan conducted by Checkmarx occurred in January 2013, and it revealed that 18 of the top 50 most popular plug-ins had vulnerabilities. A second scan conducted in June 2013 showed the number had been cut to 12.
“As people who work with source code and security, we can’t say we were surprised by vulnerabilities,” Siman said. “The amount of the vulnerabilities, at a staggering 20 percent of the top 50 plug-ins, were, however, extremely surprising. Especially the e-commerce plug-ins were surprising, because the people who deal with e-commerce you would think would be more concerned with the overall security of their plug-ins.”
While every line of code has the potential of introducing a vulnerability, Checkmarx found that there was no correlation between the number of lines of code and the vulnerability level of the plug-ins. On the contrary, some plug-ins included only a few thousand lines of code, but had more vulnerabilities than plug-ins containing tens of thousands of lines of code, according to the company’s paper.
According to Checkmarx, administrators for WordPress sites should only download plug-ins from reputable sources—in this case, WordPress.org. In addition, the security of plug-ins should be assessed by scanning it for security issues. Old or unused plug-ins should be removed.
Meanwhile, application platform providers need to enforce a security policy on apps that enter the marketplace and make sure they are only authorizing apps that meet their standards, the firm said.
“The world is shifting towards software distribution platforms,” Siman noted in a blog post. “App marketplaces continue to tell us that their platforms are secure, but don’t buy into those word games. Only if they start enforcing the security of the apps they distribute, [could we] seriously talk about the security of distribution platforms.”

Article source: http://www.eweek.com/security/popular-wordpress-plugins-vulnerable-to-attack-checkmarx-research/

Karaoke Gets on the Digital Runway

Nashville, TN — (SBWIRE) — 06/18/2013 — DigiTrax Entertainment, creators of the Karaoke Cloud, will host its 2nd annual Karaoke Summit Thursday, June 20 in Nashville. Attending will be karaoke music label executives, music publishers, entertainment/intellectual properties attorneys and more. This summit will focus on solutions for the American karaoke industry in reference to licensing and piracy issues.

“We are honored to have legal representation from the NMPA, Piracy Recovery and Allen Jacobi Law. This is going to be one very informative summit,” stated Joe Vangieri CEO DigiTrax Entertainment.

Summit topics and speakers include:

The National Music Publishers Association (NMPA), Legal Fellow, Natalie Madaj on the topic of Reform Sync Licensing Now – How Labels and Publishers Can Make More Money and Reduce Overhead. Ms. Madaj will state the case for reform in karaoke and video sync licensing and how it would ultimately lead to more profit for publishers.

Sync Licensing In the Global Economy- Contrasting Rights in the US and Abroad, by Allen Jacobi, Allen Jacobi Law. Mr. Jacobi will illustrate how our competitive markets of the UK and EU have an advantage in compulsory licensing. UK and EU karaoke labels are flourishing while the American counterparts are laboring under difficult licensing practices. Allen Jacobi is a pioneering entertainment industry attorney who has successfully been able to combine music, motion picture and television into a single career.

Piracy Interdiction Efforts- Karaoke song theft in the karaoke bar industry. Roby Robinson Registered U.S. Patent Attorney, Luedeka Neely Group, P.C. representing Piracy Recovery. Mr. Robinson will update the Summit on current litigation for World-Wide Digital / Piracy Recovery in TN. He will also lay out Piracy Recovery’s National program.

“Honest working Karaoke Jockeys and karaoke recording labels are affected by piracy. Almost all of the major American karaoke brands like Sound Choice, Chartbuster and Priddis have been terminally effected by piracy,” stated David Harb President of Piracy Recovery. “Honest Karaoke Jockeys are making less money because of piracy, but that’s all about to change with our undercover national karaoke investigations.”

This year’s Karaoke Summit will be filled with a very thorough review of the industry’s problems, new and innovative approaches through technology and piracy litigation to help fix this crippled American industry.

About DigiTrax Entertainment
DigiTrax is a global company dedicated to bringing high-quality, interactive, music services to market. DigiTrax’s main offerings include Karaoke Cloud, a consumer subscription karaoke platform, and its professional version, Karaoke Cloud Pro, for karaoke show hosts.

Article source: http://www.sbwire.com/press-releases/karaoke/karaoke-summit/sbwire-267804.htm

E-Commerce WordPress Plugins Riddled With Flaws, Study Finds

WordPress plugins that are used to add e-commerce functionality to business websites are riddled with vulnerabilities, according to a new study released today.

Israeli application security firm Checkmarx said its WordPress plugin analysis found seven out of the 10 most popular e-commerce plugins contain vulnerabilities. The security firm found SQL injection errors and cross-site scripting flaws that are most frequently targeted by attackers.

“Every developer can upload their plugin to the WordPress.org market and any user can download that plugin with no security assurance process in place,” said Maty Siman, founder and CTO of Checkmarx. “In certain cases, you can exploit a vulnerability to get full access control to the hosting server, and in many cases you can get access to other WordPress sites hosted on the same server.”

[Related: 5 Dangerous Web Application Flaws Coveted By Attackers]

Attackers have been targeting WordPress users due to the platform’s popularity; an estimated 60 million websites are built with the content management system. Automated tools can scan and exploit common Web application vulnerabilities, enabling attackers to set up drive-by attacks or use the back-end systems to set up command-and-control servers for botnets.

“With 18 percent of the total Internet based on WordPress, a single vulnerability can impact millions of websites all at once,” Siman said.

WordPress, Joomla and Drupal are among the most popular platforms. Attackers can also steal data from Web servers or redirect website visitors to another attack websites, Siman told CRN. Siman said the website vulnerabilities serve as an easy way for attackers to spread malware and expand their botnets, taking control of larger armies of infected PCs.

Checkmarx performed multiple scans on the top 50 most downloaded plugins as part of its study. Some website owners don’t have the resources or skill level to apply updates, although newer versions of WordPress can be set to automatically update plugins, Siman said. In addition to installing security updates issued by each platform, Siman said users need to apply patches to plugins and uninstall components that are not used.

The firm found that e-commerce plugins, such as those that add shopping cart functionality to a site, were typically riddled with coding errors. Plugins that helped setup and manage a store also contained errors.

“We assumed that these plugins would be more secure but that wasn’t the case,” Siman said. “Developers want to get the most users as possible and many forgo security to get their functionality to market faster.”

Other top error-prone plugins included components that help website owners manage site statistics, review comments in site forums or blog entries, or save contact form data. Sites also had errors associated with feed aggregators, broken links, site development tools and connections to popular social networks, including Facebook, according to Checkmarx’s study.

Siman recommends that WordPress site owners stick to WordPress.org when downloading plugins. Site owners can also use scanning tools to check plugins for flaws and make a knowledgeable decision on whether using them are worth the risks they pose. Stick to the latest version of plugins, he said, and remove any unused plugins that are hosted on the site.

An attacker can still gain access to vulnerable plugins even if they are disabled, Siman said. To remove the threat completely, plugins must be uninstalled.

The firm highlighted six popular plugins for correcting coding errors that Checkmarx found in January: BuddyPress, a plugin that creates a social network; BBPress, forum software; E-Commerce, a shopping cart plugin; Supper Cache, a site optimization plugin; and Woo Commerce, an e-commerce store.

Wordpress.org volunteers did not respond to CRN’s request for comment Tuesday. The platform maintains a security FAQ for website owners. Users who may have fallen victim to an attack are directed to an exploit scanner plugin that examines database tables and plugins for irregularities or unusual file names.

PUBLISHED JUNE 18, 2013

Article source: http://www.crn.com/news/security/240156883/e-commerce-wordpress-plugins-riddled-with-flaws-study-finds.htm

Popular WordPress E-Commerce Plugins Riddled With Security Flaws

WordPress plugins that are used to add e-commerce functionality to business websites are riddled with vulnerabilities, according to a new study released today.

Israeli application security firm Checkmarx said its WordPress plugin analysis found seven out of the 10 most popular e-commerce plugins contain vulnerabilities. The security firm found SQL injection errors and cross-site scripting flaws that are most frequently targeted by attackers.

“Every developer can upload their plugin to the WordPress.org market and any user can download that plugin with no security assurance process in place,” said Maty Siman, founder and CTO of Checkmarx. “In certain cases, you can exploit a vulnerability to get full access control to the hosting server, and in many cases you can get access to other WordPress sites hosted on the same server.”

[Related: 5 Dangerous Web Application Flaws Coveted By Attackers]

Attackers have been targeting WordPress users due to the platform’s popularity; an estimated 60 million websites are built with the content management system. Automated tools can scan and exploit common Web application vulnerabilities, enabling attackers to set up drive-by attacks or use the back-end systems to set up command-and-control servers for botnets.

“With 18 percent of the total Internet based on WordPress, a single vulnerability can impact millions of websites all at once,” Siman said.

WordPress, Joomla and Drupal are among the most popular platforms. Attackers can also steal data from Web servers or redirect website visitors to another attack websites, Siman told CRN. Siman said the website vulnerabilities serve as an easy way for attackers to spread malware and expand their botnets, taking control of larger armies of infected PCs.

Checkmarx performed multiple scans on the top 50 most downloaded plugins as part of its study. Some website owners don’t have the resources or skill level to apply updates, although newer versions of WordPress can be set to automatically update plugins, Siman said. In addition to installing security updates issued by each platform, Siman said users need to apply patches to plugins and uninstall components that are not used.

The firm found that e-commerce plugins, such as those that add shopping cart functionality to a site, were typically riddled with coding errors. Plugins that helped setup and manage a store also contained errors.

“We assumed that these plugins would be more secure but that wasn’t the case,” Siman said. “Developers want to get the most users as possible and many forgo security to get their functionality to market faster.”

Other top error-prone plugins included components that help website owners manage site statistics, review comments in site forums or blog entries, or save contact form data. Sites also had errors associated with feed aggregators, broken links, site development tools and connections to popular social networks, including Facebook, according to Checkmarx’s study.

Siman recommends that WordPress site owners stick to WordPress.org when downloading plugins. Site owners can also use scanning tools to check plugins for flaws and make a knowledgeable decision on whether using them are worth the risks they pose. Stick to the latest version of plugins, he said, and remove any unused plugins that are hosted on the site.

An attacker can still gain access to vulnerable plugins even if they are disabled, Siman said. To remove the threat completely, plugins must be uninstalled.

The firm highlighted six popular plugins for correcting coding errors that Checkmarx found in January: BuddyPress, a plugin that creates a social network; BBPress, forum software; E-Commerce, a shopping cart plugin; Supper Cache, a site optimization plugin; and Woo Commerce, an e-commerce store.

Wordpress.org volunteers did not respond to CRN’s request for comment Tuesday. The platform maintains a security FAQ for website owners. Users who may have fallen victim to an attack are directed to an exploit scanner plugin that examines database tables and plugins for irregularities or unusual file names.

PUBLISHED JUNE 18, 2013

Article source: http://www.crn.com/news/security/240156883/e-commerce-wordpress-plugins-riddled-with-flaws-study-finds.htm

How Is Facebook’s React JavaScript Library?

Ben Alpert, Software Engineer at Khan Academy

(Writing here to provide another perspective because I don’t work at Facebook Facebookor Instagram and only learned of React last week when it was first announced publicly.)

I’d looked briefly at Ember and Angular and was intending to write something in each to test them out, but React caught my eye last week.

I just rewrote a 2000-line project in React and have now made a handful of pull requests to React. Everything about React I’ve seen so far seems really well thought-out and I’m proud to be the first non-FB/IG production user of React.

The project that I rewrote in React (and am continuing to improve) is the Khan Academy question editor that content creators can use to enter questions and hints that will be presented to students:

The left side has the actual editor, while the right side of the page shows a live preview of the question you’re writing. Originally, the editor would serialize the entire question and give it to the previewer, which rendered the question to the page.

Performance was a concern with the old editor, so I had it keep track of whether the question, the answer area, or the solution was changing and only rerender the appropriate part. Unfortunately, the interface was still annoyingly slow because we would still often rerender more than the specific changed pieces; putting more dirty-checking logic into the editor–renderer interface seemed like it would only make the code more convoluted and harder to maintain.

(An aside: why was rendering so slow? The primary culprit is MathJax, which we use to render math expressions within the text. Even typesetting a few simple expressions (like y = 3x – 5 in the screenshot above) takes on the order of 200ms on my computer, and much longer on slower machines.)

React’s declarative interface seemed to be perfect for my needs because it allows simply writing how the document tree should look and it will intelligently determine which changes need to be made; it won’t touch the DOM when it doesn’t have to. I rewrote the renderer completely declaratively and React takes care of figuring out what to update. The source shrunk by a few hundred lines and updating the preview takes an order of magnitude less time than it did previously.

I think my favorite thing about React is that it’s simple. As an example, the Angular documentation for how to write a directive (a reusable component) needs to explain directive priorities, the difference between compiling and linking, the creation of new scopes, and transclusion, all of which are Angular-specific concepts. In contrast, React recommends that you learn JSX, but after that it’s just JavaScript, so everything you know about JavaScript still applies. As far as I can tell, React’s approach here is just as powerful as other frameworks but won’t be any harder to maintain.

React’s code feels reasonably mature to me – since it’s been used by both Facebook and Instagram in production for a while now, it looks like most of the bugs have been ironed out. It doesn’t do everything for you yet (e.g., automatic async promise support or two-way data binding like Angular’s ng-model or Ember’s TextField) but what’s there seems to work really well.

The biggest complaint I’ve had is that the docs are sometimes unclear and the best practices aren’t clearly documented yet. However, this shouldn’t prevent anyone from using React. In addition, I’ve found that the developers are really helpful on IRC, and I have no doubt that the documentation will only get better over time. I love React so far and am now working on convincing my coworkers to use it with me.

This question originally appeared on Quora. More questions on JavaScript:

Article source: http://www.forbes.com/sites/quora/2013/06/18/how-is-facebooks-react-javascript-library/

Storkie Express, Inc. Launches Storkie.com 5.0 with Responsive Design and …

  • Email a friend

Storkie.com 5.0 on PC, Tablet, and Mobile Phone

Fort Lauderdale, Florida (PRWEB) June 18, 2013

Storkie Express, Inc. has launched the 5th-generation of its website, featuring responsive design technology, HTML5 and CSS3 to transform the online shopping experience for custom-printed invitations and cards.

Storkie was one of the first invitation companies online, introducing Storkie.com 1.0 in 1999. Storkie.com 5.0 represents the company’s continued commitment to innovation and industry leadership. The all-new shopping experience makes it easier and even more fun to browse and create beautiful invitations, cards and announcements on any device and screen resolution, whether shopping on a PC, tablet or mobile phone. With the new design and features, Storkie 5.0 is the most advanced invitation shop online.

David Gudai, CMO of Storkie, said, “Design defines so much of the customer experience, and our intent for this next generation website was to create an aesthetic marked by simplicity, clarity and balance. Leveraging the latest technologies with new approaches to depth and animation, we were able to create an immersive, fluid shopping platform that represents the future of the web experience. Parallax elements and user personalization facilitate entirely new ways to explore and interact with the Storkie website.”

In addition to an all-new user interface, Storkie 5.0 is packed with new features, including: integrated photo upload from Facebook, Instagram and Flickr; a significant revamp of the product catalog page to include larger catalog images and dynamic catalog personalization; and a tailored mobile browsing experience.

For more information, visit Storkie at http://www.storkie.com.

About Storkie Express, Inc.

Storkie Express is an online-based invitation company providing customers with quality, affordable custom-printed invitations, announcements and cards since 1990. Storkie has been an industry innovation leader unveiling exclusive custom-design technology, and transforming the customer experience for stationery shopping. At Storkie.com, customers can easily design and order unique personalized invitations at the best prices and fastest turnaround time offered in the industry.

Email a friend


PDF


Print

Article source: http://www.prweb.com/releases/storkie/responsive-html5/prweb10842850.htm