I've rebuilt kief.com using new software, a PHP-based content management system called Drupal. I didn't have any particular problem with my old software, Movable Type, I changed because I wanted to learn how Drupal works. Movable Type is designed for use in a weblog format, with backwards-chronological list of posts, which is fine for kief.com. But I've been wanting to create a new website which will have a more complicated format which I think Drupal is well-suited for.

The choice of Drupal is significant for me in that it is written using a language/technology I haven't worked with before, PHP. This isn't out of any desire to learn PHP, I would actually prefer to use Java, which is what I work with professionally. However, I've been farting around with Java-based content management for years, and it's actually been a big obstacle for me starting the kind of website I would like to have, for several reasons.

Part of the reason I haven't been able to get a Java-based, content/community-oriented website going is exactly because I am a Java programmer. Whenever I have started on one of these projects in the past, I inevitably get bogged down fiddling with the software, and usually end up wanting to write big chunks of the system myself. The software is never quite done the way I want it, so I spend all my time coding. Since I don't have gobs of free time for this kind of project, I never get anywhere with it. Since the projects I want to do are usually building websites rather than writing software, this is counter-productive.

This problem is exacerbated by the state of Java content management systems. There are plenty of frameworks out there that can be used to build a content-oriented site, but nothing that you can just drop into place and start using. I particularly like JPublish, and also Daisy, but either one (or both) would take a lot of work to get going with.

The reason I've started playing with Drupal is that it's oriented towards the type of site I would like to start - mixing community (blogs, forums, comments), and old-style traditional content. It has some fairly large gaps - it doesn't handle images very nicely yet, and it seems awkward to create pages that collect different types of content in useful ways, such as section hubs and monthly archives. But it's technical architecture looks very clean, solid, and extensible, and there is plenty of activity with modules that can do the kinds of things I'm interested in.

Of course none of this actually guarantees I will get a new site underway any time soon, there is still plenty of work to do.

When we were in the US over the holidays, the Mrs. and I were perplexed by the car ribbon fad. Most cars in the US have magnetic ribbons on the back, most of which seem to be based on the traditional yellow "support the troops" motif, although there are a variety of colors and occasionally different messages. I didn't realize they were magnetic at first, I thought they were painted or stuck on like dealership logos and similar crap that most cars have these days - which made me wonder whether people had decided we were in for the long haul.

There is something warped about this. The classic tradition was to tie a piece of yellow ribbon around a tree in your yard, and later around the antenna of your car, when you had a family member off at war. Partly it was for luck, hoping that your son would return safely, partly it was a reminder for others to keep the soldiers in their thoughts and prayers.

The yellow ribbon tradition has changed over the years. Nowadays it's appropriate for anyone who wants to show that they're thinking of the welfare of American troops in danger's way to put up a ribbon, not just those with a family member at war. An important point is that
it doesn't (or shouldn't) matter what you felt about the war itself. A yellow ribbon is not a statement for or against the war, it's about the men and women who might not return from it.

But what I saw in the US this last time is that the yellow ribbin tradition has been perverted, in a distinctly modern American way. First of all, it's apparently not good enough to display a simple, cheap yellow ribbon, instead you must buy a manufactured product. The genuine cloth ribbon is pushed aside by an artificial, manufactured facsimile.

Of course, in America you don't sell a single, simple product, you must offer many different variations. So there are different colors of magnetic ribbons, and different slogans for them. Now it's possible to show more than your support of the troops, you can use the ribbon to show your support or contempt for people who don't share your view of the war and the world. There are even anti-war ribbons - "Support our troops, send them home" - so everyone can play, and pay. Many of the different colored ribbons are even for non-troop related things, so they're now a generic way to advertise your political views, they're the new bumper sticker.

This profusion of ribbons leads to the second perversion of the original tradition, which is to show everyone else that you support the troops more than they do, by having a larger collection of ribbons plastered on the rear of your car than they do. Most of the cars we saw had at least 3, and often as many as 5 or 6, different colored ribbons. Build your collection, show the Jones next door that they're not as patriotic as you are! I wonder how long it will be before there are limited edition collectable magnetic ribbons being sold on ebay for hundreds of dollars.

So the yellow ribbon is being trivialized, it's now become a joke. You can have them custom made with funny slogans to lampoon the original trend.

Oh, baby!

Dear Customer,

Thank you for choosing Dell.

Your order is being custom-built to your requirements at our factory.

As we custom build each order to your exact specification, it can take up to ten working days to build and deliver your order.

I've been suffering on a four year old laptop. It was a decent machine at the time, but 192 megs is unusable for development work. It was a tough choice between a desktop and a laptop, I really like the portability of a laptop, but the bang:buck ratio of the desktop won me over. 2 Gigs of RAM, piles of hard drive space, and a 19" flat panel. Man, I can't wait!

Hell. Handbasket.

Fooled us once, shame on him. Fooled us twice ....

I know they do, because it's in commercials and there are Halloween parties, but this is probably the 4th or 5th Halloween I've spent in London, and I've never seen a single trick or treater. Too bad, we'll just have to eat the candy ourselves.

Had a major server disaster, the power supply died. I finally managed to borrow a spare, so we're back in action, but from Thursday evening until a short while ago I had no mail server. This is one of the disadvantages of hosting on your own hardware. On the plus side, it's still pretty cheap.

This comes a week after losing the power supplies on two servers at work. It's a truism that the power supply is almost always the weak point of cheap hardware. At my last job we had a slew of boxes like this one, Sun clones from Transtec with Sparc processors, and the power supplies died on pretty much all of those as well; mine was probably the last one from that batch to go.

The servers at work are SuperMicro, another a dirt cheap brand which skimps on the power supply. Personally, I prefer HP [Compaq] Proliants, although I'll live with Dells.

Testing a new version of the weblogging software I use to manage this site.

OK, so I've pieced together some more of what's going on with my WAP SSL problem. It turns out that on old-skool WAP phones, SSL encryption does not happen from the phone, but instead is done between the WAP gateway, usually at the network operator, and the web(WAP) site. The connection between the phone and the WAP gateway is encrypted with WTLS, Wireless Transport Layer Security. This is a wireless version of TLS, which is a more general Internet standard.

But newer phones, the ones with their own TCP/IP stack, use regular TLS, which allows them to have proper SSL end to end, from the phone to the site.

This much I have confirmed from googling and foruming, but I still have not found any explicit mention of how this affects the MSISDN issue. It stands to reason the WAP gateway isn't going to be able to insert the MSISDN into the headers in this case, but this has some fairly serious implications for the way secure WAP applications are designed. Having the operator provide the MSISDN is a very useful thing, it gives you a fairly reliable way to identify people, and can even be used to authenticate them to a certain degree.

Well, it's good to be learning new stuff!

Something we're trying to determine is whether or not there is a problem getting MSISDN numbers on SSL connections from Symbian phones. MSISDN is essentially the phone number of the mobile phone, which some network operators provide as an HTTP header to authorized content providers such as ourselves, so it can be used to authenticate the phone.

We get these fine on lower-end phones whether we're using plain HTTP or SSL, but on Nokia 6600's and others we only get the MSISDN on clear connections. This may be an issue with the operators' gateway configuration, or it may be more fundamental. Is it possible Symbian's network stack prevents the operators from inserting headers into the request with an SSL connection?

For that matter, how can they insert the header even on the lower-end phones, given that the phone recognizes our server's SSL certificate, which suggests the gateway is not acting as a man-in-the-middle?

More research needed.

kief.com was down from Thursday evening until a little while ago, thanks to a power outage. Can't complain about free hosting space, can I? Aside from the loss of traffic (dozens of hits, I'm sure), I'm sure I did lose some email. If you tried to send me mail since Thursday, please try again.